@basein/runner 0.2.12 → 0.3.1

package/dist/record/remote-recorder.js

@@ -8,102 +8,488 @@
  *   PATCH /recordings/runs/:id/steps/:stepId
  *   POST  /recordings/runs/:id/finish
  *
- * Four properties matter, and each is load-bearing:
+ * The properties that matter, each load-bearing:
  *   - **Client-generated ids** (`run_`/`step_` uuids) so callers get an id
  *     synchronously and never await the network on the hot path.
- *   - **One ordered promise chain per run**, so steps arrive in the order they
- *     were recorded even though every send is fire-and-forget.
- *   - **Best-effort.** A failed send is logged and dropped, never retried inline
- *     and never thrown at the caller (§10).
- *   - **One token refresh on 401**, then one retry. Sessions outlive access tokens.
+ *   - **One ordered lane per run**, so steps arrive in the order they were
+ *     recorded even though every send is fire-and-forget.
+ *   - **Best-effort, and invisible when the service is not there.** A failed
+ *     send is logged once per run and dropped, never thrown at the caller
+ *     (§10). Every request has a deadline (`BIR_SERVICE_TIMEOUT_MS`), every
+ *     answer or its absence is reported to the process-wide health verdict
+ *     ({@link serviceHealth}), and while that verdict says the service is
+ *     cooling down the calls a hook waits on — `getMatch`, `runCreated`,
+ *     `matchIntent` — answer "no match" at once instead of making the user wait,
+ *     and `flush` returns at once, leaving the rest to drain in the background.
+ *     A run's create that fails its first attempt answers "no match" at once
+ *     too; its retry is for the recording, never for a hook.
+ *   - **One probe, not a stampede.** While the breaker is half-open, one
+ *     queued send finds out for all the lanes; the rest wait for its verdict
+ *     and then follow it a moment apart, not all at once.
+ *   - **Bounded.** The lanes are the real backlog (the hook server's step queue
+ *     drains instantly into them), so they carry the bound: past
+ *     {@link DEFAULT_MAX_PENDING_SENDS} sends or {@link DEFAULT_MAX_PENDING_BYTES}
+ *     the oldest unsent *step* is dropped and counted — creates and finishes go
+ *     last, so the service is not left with runs that never end.
+ *   - **One token refresh on 401**, shared by every send that meets the same
+ *     expiry, then one retry. Sessions outlive access tokens.
+ *   - **It follows credentials.json.** `bir logout` removes the file; a
+ *     recorder that loaded its session from it stops sending within seconds,
+ *     rather than recording for the rest of the access token's life.
+ *   - **It redacts and caps every free-text field it sends** — the prompt, the
+ *     answer, reasoning, errors — as the last line of defence. Structured tool
+ *     payloads are redacted by their producers; text is only ever seen here.
  *
  * SIMILAR-PROMPT HITS. `POST /recordings/runs` may answer `{ id: null, matched }`,
  * meaning the server recognised the prompt and did **not** create a run. Every
  * later step post for that id would then 404, so callers must stop recording —
- * {@link RemoteRecorder.getMatch} is how they find out. v1 only stops; replay is v2.
+ * {@link RemoteRecorder.getMatch} is how they find out — and this recorder skips
+ * them itself too, for the caller that stopped waiting before the answer came.
  */
 import { randomUUID } from "node:crypto";
-import { loadCredentials, saveCredentials } from "../auth/client.js";
-import { logLine, errText } from "../util/log.js";
+import { statSync } from "node:fs";
+import { credentialsPath, describeBody, isAuthResponse, issuedFor, loadCredentials, saveCredentials, } from "../auth/client.js";
+import { errText, logDetail, logEvery, logLine } from "../util/log.js";
+import { isUnhealthyStatus, serviceHealth, serviceTimeoutMs, timeoutSignal, } from "../util/service-health.js";
+import { redactJsonText, redactText } from "./redact.js";
+import { capJsonText, capText, DEFAULT_MAX_PAYLOAD_BYTES, preCut } from "./truncate.js";
+/**
+ * Caps for the free text this recorder sends, in UTF-8 bytes. Tool payloads
+ * arrive capped at 64 KiB by their producers; text never passed through one,
+ * so a pasted 3 MB log used to go out whole — once as the run's input, again
+ * in the execution report — and spend the prompt's match budget uploading.
+ */
+export const TEXT_CAPS = {
+    /** The prompt: the run's `input`, and an execution report's `prompt`. */
+    prompt: 32 * 1024,
+    /** The final answer, and the run's `finalOutput`. */
+    answer: 64 * 1024,
+    /** A step's written reasoning. */
+    context: 8 * 1024,
+    /** A step's thinking text, sent only to be embedded. */
+    intent: 8 * 1024,
+    /** A tool's error text when it is not JSON. */
+    toolError: 8 * 1024,
+    /** An execution report's error lines, rendered in a web page. */
+    reportError: 2 * 1024,
+};
+/** Queued sends past which the oldest unsent step is dropped (`BIR_RECORDER_MAX_PENDING`). */
+export const DEFAULT_MAX_PENDING_SENDS = 500;
+/** Queued bytes past which the same happens (`BIR_RECORDER_MAX_PENDING_BYTES`). */
+export const DEFAULT_MAX_PENDING_BYTES = 32 * 1024 * 1024;
+/** How long a probe waits when its caller did not say. Its answer is useless after a hook's budget. */
+export const PROBE_TIMEOUT_MS = 5_000;
+/**
+ * How long {@link RemoteRecorder.flush} waits when its caller did not say
+ * (`BIR_FLUSH_TIMEOUT_MS`). Every caller is a hook or a shutdown, and a
+ * healthy service drains a turn's last few sends in well under a second.
+ */
+export const DEFAULT_FLUSH_TIMEOUT_MS = 2_000;
+/** How often a waiting flush looks at the breaker. */
+const FLUSH_POLL_MS = 25;
+/** How often, at most, credentials.json is looked at: one `stat`. */
+const CREDENTIALS_CHECK_MS = 2_000;
+/** A settled match (it holds the whole scenario) is kept this long for late readers. */
+const MATCH_TTL_MS = 10 * 60_000;
+/** A run nobody has touched for this long is forgotten entirely. */
+const RUN_STATE_TTL_MS = 6 * 60 * 60_000;
+/** And never more than this many are remembered. */
+const RUN_STATE_MAX = 2_000;
+/** Refresh this long before the access token expires, in the background. */
+const REFRESH_AHEAD_MS = 60_000;
+/** A failed early refresh is not retried sooner than this. */
+const REFRESH_AHEAD_RETRY_MS = 30_000;
+/**
+ * The longest one queued send waits for the service. Past it, a send that is
+ * still facing a cool-down is given up unsent (counted as dropped): the
+ * service has failed every probe for a minute, and sending it anyway is what
+ * made every lane hit a dead service at the same moment.
+ */
+const COOLDOWN_WAIT_MAX_MS = 60_000;
+/** A cool-down about to end is waited out even past {@link COOLDOWN_WAIT_MAX_MS}. */
+const COOLDOWN_GRACE_MS = 5_000;
+/** Lanes released after a probe succeeds go spread over up to this long. */
+const RELEASE_JITTER_MAX_MS = 2_000;
+/** How often a lane waiting for another lane's probe looks at the verdict. */
+const PROBE_POLL_MS = 1_000;
+/** After a 404 from the probe route (an older service), stop probing for this long. */
+const MATCH_INTENT_UNSUPPORTED_MS = 10 * 60_000;
+/**
+ * Statuses a background send is retried once on: the service saying it did
+ * not take the request. Not 502/504 — a gateway that gave up may have handed
+ * the request to an origin that is still inserting it, and until the service
+ * is known to deduplicate ids a repeat could record a step twice.
+ */
+const RETRY_STATUSES = new Set([429, 503]);
+/**
+ * Network failures that prove the request never reached the service — no
+ * connection, no address, or a pooled socket the far end had already closed
+ * (undici's "other side closed", before any answer) — so a repeat cannot
+ * double it. A reset mid-request is not among them.
+ */
+const SAFE_RETRY_CODES = new Set(["ECONNREFUSED", "ENOTFOUND", "EAI_AGAIN", "UND_ERR_SOCKET", "UND_ERR_CONNECT_TIMEOUT"]);
+/** A refresh that failed without an answer to act on is not tried again sooner than this. */
+const REFRESH_RETRY_MS = 30_000;
+/** After a refused refresh, how long to wait for a sibling's newer session to land on disk. */
+const AUTH_RECHECK_MS = 1_500;
+/** While the session is refused, how often it is tried again anyway. */
+const AUTH_REJECTED_RETRY_MS = 10 * 60_000;
+/** Execution reports ride their own lane: a matched turn has no run on the service. */
+const EXECUTIONS = "__executions__";
+/** A send that did not succeed, with the status the service answered, if it answered. */
+export class ServiceError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = "ServiceError";
+    }
+}
+/** The service's own answer that this refresh token is no good (a JSON 400/401). */
+class RefreshRejected extends ServiceError {
+}
+/** Another account signed in while a send was between attempts: it is not sent under the new one. */
+class AccountChanged extends Error {
+    constructor(what) {
+        super(`${what}: another account signed in — not sent under it`);
+        this.name = "AccountChanged";
+    }
+}
+function pend(text, max, json = false) {
+    if (typeof text !== "string")
+        return undefined;
+    const cut = preCut(text, max);
+    return { text: cut.text, bytes: cut.bytes, max, json };
+}
+/**
+ * The field as sent: capped and redacted. A JSON payload is redacted as JSON
+ * ({@link redactJsonText}), so it stays JSON and — when its producer already
+ * redacted it — keeps its exact bytes.
+ */
+function out(p) {
+    if (!p)
+        return undefined;
+    return p.json ? capJsonText(p.text, p.max, redactJsonText, p.bytes) : capText(p.text, p.max, redactText, p.bytes);
+}
+function sizeOf(...parts) {
+    let n = 256;
+    for (const p of parts)
+        n += p?.text.length ?? 0;
+    return n;
+}
+/** A tool error is JSON when a producer serialized it, and prose when it did not. */
+function pendError(text) {
+    if (typeof text !== "string")
+        return undefined;
+    return /^\s*[{[]/.test(text) ? pend(text, DEFAULT_MAX_PAYLOAD_BYTES, true) : pend(text, TEXT_CAPS.toolError);
+}
+function positiveEnv(name, fallback) {
+    const n = Number(process.env[name]);
+    return Number.isFinite(n) && n > 0 ? Math.floor(n) : fallback;
+}
+function reasonOf(err) {
+    const cause = err?.cause;
+    return cause?.code ?? cause?.message ?? errText(err);
+}
+/** The network error's code: undici's cause, or the first of a happy-eyeballs AggregateError's. */
+function causeCode(err) {
+    const cause = err?.cause;
+    return cause?.code ?? cause?.errors?.[0]?.code;
+}
+/**
+ * An answer that is a web page rather than the API: a captive portal, a
+ * website, a CDN challenge. Judged by the body — an empty or plain-text 2xx
+ * is the API answering, whatever content type a framework's `res.send("ok")`
+ * put on it.
+ */
+function isWebPage(text, type) {
+    if (/^\s*<(!doctype|html|head|body)\b/i.test(text))
+        return true;
+    return /html/i.test(type) && /^\s*</.test(text);
+}
+/** A JSON object — the shape of the service's own error answers. */
+function isJsonObject(text) {
+    try {
+        const v = JSON.parse(text);
+        return typeof v === "object" && v !== null && !Array.isArray(v);
+    }
+    catch {
+        return false;
+    }
+}
+/** `p`, or a rejection as soon as `signal` aborts. `p` keeps running; its outcome is observed either way. */
+function untilAborted(p, signal) {
+    if (signal.aborted) {
+        p.catch(() => undefined);
+        return Promise.reject(signal.reason);
+    }
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(signal.reason);
+        signal.addEventListener("abort", onAbort, { once: true });
+        p.then((v) => {
+            signal.removeEventListener("abort", onAbort);
+            resolve(v);
+        }, (e) => {
+            signal.removeEventListener("abort", onAbort);
+            reject(e);
+        });
+    });
+}
+function detail(text, type) {
+    const d = describeBody(text, type);
+    return d ? ` — ${d}` : "";
+}
+function sleep(ms, unref = false) {
+    return new Promise((resolve) => {
+        const timer = setTimeout(resolve, ms);
+        if (unref)
+            timer.unref?.();
+    });
+}
+/** Call a caller's hook; its failure is never the request's. */
+function notify(fn) {
+    try {
+        fn?.();
+    }
+    catch {
+        /* never */
+    }
+}
+/** 250-750 ms: long enough for a load balancer to replace a dead socket, short enough to be unnoticed. */
+function jitterMs() {
+    return 250 + Math.floor(Math.random() * 500);
+}
+/** A 429/503's own Retry-After, capped at 2 s; otherwise jitter. */
+function retryDelayMs(res) {
+    const header = res.headers.get("retry-after");
+    if (header) {
+        const seconds = Number(header);
+        const ms = Number.isFinite(seconds) ? seconds * 1000 : Date.parse(header) - Date.now();
+        if (Number.isFinite(ms))
+            return Math.min(2_000, Math.max(0, ms));
+    }
+    return jitterMs();
+}
+const PAUSE_WHY = {
+    signed_out: "credentials.json was removed (bir logout) — nothing more is sent and replay stops until you sign in again",
+    auth_rejected: "the service refused this session and no newer one was on disk — run `bir login`; recording resumes on its own (the session is also retried every 10 minutes)",
+    other_service: "credentials.json now belongs to a different service address — restart the recorder (or run `bir setup`) to record there",
+};
+const DEAD_WHY = {
+    not_found: "the service has no such run (its create never landed) — the rest of this run is skipped",
+    create_rejected: "the service refused to create the run — the rest of this run is skipped",
+    account_changed: "another account signed in on this machine — the rest of this run is skipped",
+    dropped: "the backlog bound dropped this run's create — the rest of it is skipped",
+    service_down: "the service failed every probe for a minute, so this run's create was never sent — the rest of it is skipped",
+};
 export class RemoteRecorder {
     baseUrl;
     framework;
+    health;
+    /** The service these credentials are bound to; never changes for this recorder. */
+    binding;
+    maxPendingSends;
+    maxPendingBytes;
+    credentialsCheckMs;
     session;
-    /** runId → tail of that run's ordered send chain. */
-    chains = new Map();
-    /** runId → the similar-prompt outcome of its create call. */
-    matches = new Map();
-    /** runId → what the create call said (not created: a hit, nothing to record). */
-    created = new Map();
+    state = "recording";
+    runs = new Map();
+    lanes = new Map();
+    seq = 0;
+    pendingSends = 0;
+    pendingBytes = 0;
+    droppedSends = 0;
+    failedSends = 0;
+    backlogFull = false;
+    droppedWhileFull = 0;
+    lastSweep = 0;
+    refreshing;
+    /** A failed refresh is not tried again before this (epoch ms). */
+    refreshRetryAt = 0;
+    authRecheckMs;
+    authRetryMs;
+    cooldownWaitMaxMs;
+    /** When the session was last refused or retried while refused. */
+    rejectedAt = 0;
+    lastAheadAttempt = 0;
     /**
-     * Execution reports ride their own chain: a matched turn has no run on the
-     * service (that is what a match means), so there is no run chain to append to.
+     * The one request out while the breaker is half-open — a lane's own send,
+     * or a hook-requested `GET /health` — and when it started.
      */
-    executionChainKey = "__executions__";
+    probe;
+    matchIntentOffUntil = 0;
+    /** True once this recorder's session is known to be the one in credentials.json. */
+    follow = false;
+    credMtime = -1;
+    credCheckedAt = 0;
     constructor(opts) {
         this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
         this.session = opts.session;
         this.framework = opts.framework ?? "baseinstrunner";
+        this.health = opts.health ?? serviceHealth;
+        this.binding = (opts.session.authUrl ?? this.baseUrl).replace(/\/+$/, "");
+        this.maxPendingSends = opts.maxPendingSends ?? positiveEnv("BIR_RECORDER_MAX_PENDING", DEFAULT_MAX_PENDING_SENDS);
+        this.maxPendingBytes =
+            opts.maxPendingBytes ?? positiveEnv("BIR_RECORDER_MAX_PENDING_BYTES", DEFAULT_MAX_PENDING_BYTES);
+        this.credentialsCheckMs = opts.credentialsCheckMs ?? CREDENTIALS_CHECK_MS;
+        this.authRecheckMs = opts.authRecheckMs ?? AUTH_RECHECK_MS;
+        this.authRetryMs = opts.authRetryMs ?? AUTH_REJECTED_RETRY_MS;
+        this.cooldownWaitMaxMs = opts.cooldownWaitMaxMs ?? COOLDOWN_WAIT_MAX_MS;
+        // Follow the file only when this session came from it. A synthetic session
+        // (BIR_AUTH_DISABLE, tests) has no file, and must not read "no file" as
+        // "signed out".
+        try {
+            const mtime = statSync(credentialsPath()).mtimeMs;
+            const stored = loadCredentials();
+            if (stored &&
+                stored.user.id === opts.session.user.id &&
+                issuedFor(stored, this.binding) &&
+                (stored.accessToken === opts.session.accessToken || stored.refreshToken === opts.session.refreshToken)) {
+                this.follow = true;
+                this.credMtime = mtime;
+                this.credCheckedAt = Date.now();
+            }
+        }
+        catch {
+            /* no file: nothing to follow */
+        }
+    }
+    /**
+     * The access token this recorder is using *now*. It changes on every refresh
+     * (and when a sibling process's refresh is adopted), so callers that need the
+     * token — replay's service derivation, the source-run fetch — must read it
+     * through this each time rather than keep the startup session. Undefined once
+     * the session is gone (`bir logout`) or was refused.
+     */
+    currentAccessToken() {
+        this.checkCredentials();
+        if (this.state !== "recording")
+            return undefined;
+        return this.session.accessToken || undefined;
+    }
+    /** The backlog and sending state, for `/health` and `bir doctor`. */
+    recorderHealth() {
+        return {
+            state: this.state,
+            pendingSends: this.pendingSends,
+            pendingBytes: this.pendingBytes,
+            droppedSends: this.droppedSends,
+            failedSends: this.failedSends,
+        };
     }
     startRun(input, metadata, options) {
         const id = "run_" + randomUUID();
-        let resolveMatch;
-        let resolveCreated;
-        this.matches.set(id, new Promise((r) => {
-            resolveMatch = r;
-        }));
-        this.created.set(id, new Promise((r) => {
-            resolveCreated = r;
-        }));
-        this.enqueue(id, async () => {
-            try {
-                const body = await this.post("/recordings/runs", {
-                    id,
-                    framework: this.framework,
-                    input,
-                    metadata,
-                    // A fragment (fallbk.md D7). Omitted, not null, so an older service
-                    // that does not know the field sees the body it always saw.
-                    ...(options?.fallbackOf ? { fallbackOf: options.fallbackOf } : {}),
-                    // A chain with calls is inlined for this runner rather than stopped in
-                    // front of its first call (segmented.md R-CALL-28).
-                    supportsCalls: true,
-                });
-                const b = body && typeof body === "object"
-                    ? body
-                    : {};
-                resolveMatch(b.matched ?? null);
-                // `id: null` is the service saying it kept a run of its own. Which run
-                // that was matters: a turn must not count step hits against the
-                // recording it is itself a repeat of (R-HIT-7).
-                resolveCreated({ created: b.id !== null, fragmentOf: b.fragmentOf });
-            }
-            catch (err) {
-                resolveMatch(null); // fail-safe: on a create error, record normally
-                resolveCreated({ created: true });
-                throw err; // preserve enqueue's dropped-send logging
-            }
+        this.checkCredentials();
+        this.sweep();
+        const entry = this.newEntry();
+        this.runs.set(id, entry);
+        if (this.state !== "recording") {
+            // Nothing is sent while signed out, so there is nothing to match against
+            // and no run on the service: "fresh run", and every later send skipped.
+            entry.dead = this.state;
+            entry.settle(null, { created: true });
+            return id;
+        }
+        const prompt = pend(input ?? "", TEXT_CAPS.prompt);
+        this.enqueue({
+            lane: id,
+            runId: id,
+            kind: "create",
+            bytes: sizeOf(prompt),
+            // Dropped or skipped before it was sent: a fail-safe "fresh run, no match".
+            abandon: () => entry.settle(null, { created: true }),
+            send: async () => {
+                try {
+                    const body = await this.request("POST", "/recordings/runs", JSON.stringify({
+                        id,
+                        framework: this.framework,
+                        input: out(prompt),
+                        metadata,
+                        // A fragment (fallbk.md D7). Omitted, not null, so an older service
+                        // that does not know the field sees the body it always saw.
+                        ...(options?.fallbackOf ? { fallbackOf: options.fallbackOf } : {}),
+                        // A chain with calls is inlined for this runner rather than stopped in
+                        // front of its first call (segmented.md R-CALL-28).
+                        supportsCalls: true,
+                    }), 
+                    // The id is client-generated, so the service can tell a repeat. A
+                    // hook waiting on this answer is let go before the retry: a match
+                    // found by the retry is not the turn's any more.
+                    { retryTransient: true, onRetry: () => entry.release() });
+                    const b = body && typeof body === "object"
+                        ? body
+                        : {};
+                    // `id: null` is the service saying it kept a run of its own. Which run
+                    // that was matters: a turn must not count step hits against the
+                    // recording it is itself a repeat of (R-HIT-7).
+                    if (entry.released && b.id === null) {
+                        logLine("recorder.matched_after_retry", {
+                            run: id,
+                            why: "the create's first attempt failed, so the turn went ahead as a fresh one; the service kept its own run, and this one's steps are not sent",
+                        });
+                    }
+                    entry.settle(b.matched ?? null, { created: b.id !== null, fragmentOf: b.fragmentOf });
+                }
+                catch (err) {
+                    entry.settle(null, { created: true }); // fail-safe: on a create error, record normally
+                    throw err; // preserve the dropped-send logging
+                }
+            },
         });
         return id;
     }
-    /** What the create call said. "Created" for an id this recorder never opened. */
+    /**
+     * What the create call said. "Created" for an id this recorder never opened,
+     * and — without waiting — while the service is cooling down or the session is
+     * gone, or once the create's first attempt has failed: a hook must never wait
+     * on a service that just failed to answer, nor on the retry after it.
+     */
     async runCreated(runId) {
-        const pending = this.created.get(runId);
-        return pending ? await pending : { created: true };
+        const entry = this.runs.get(runId);
+        if (!entry)
+            return { created: true };
+        entry.lastUsed = Date.now();
+        if (entry.settled)
+            return entry.settled.created;
+        if (entry.released || !entry.hot || !this.mayHotWait())
+            return { created: true };
+        await entry.hot;
+        // Settled, or let go when the first attempt failed (then: a fresh run).
+        return entry.settled?.created ?? { created: true };
     }
     /**
      * Match a ReAct iteration's reasoning against the caller's scenario intents
      * (fallbk.md §Runner 4). Awaited, not queued: the caller is a `PreToolUse`
      * holding a budget, and the answer decides what that hook says. A service that
-     * predates the route (404) or any failure is a miss.
+     * predates the route (404) or any failure is a miss — and so is a service in
+     * a cool-down, without a request: the probe runs on every tool call, so a
+     * dead service must cost it nothing.
+     *
+     * `opts.signal`/`opts.timeoutMs` end the request when the caller stops
+     * waiting, so an abandoned probe does not hold a socket for minutes.
      */
-    async matchIntent(req) {
+    async matchIntent(req, opts = {}) {
         try {
-            const body = await this.post("/scenarios/match-intent", req);
+            if (!this.mayHotWait())
+                return null;
+            if (Date.now() < this.matchIntentOffUntil)
+                return null;
+            // The reasoning often quotes what the model just read — a .env, a key.
+            const body = {
+                ...req,
+                text: capText(req.text ?? "", TEXT_CAPS.intent, redactText),
+                ...(typeof req.toolInput === "string"
+                    ? { toolInput: capJsonText(req.toolInput, DEFAULT_MAX_PAYLOAD_BYTES, redactJsonText) }
+                    : {}),
+            };
+            const answer = await this.request("POST", "/scenarios/match-intent", JSON.stringify(body), {
+                signal: opts.signal,
+                timeoutMs: opts.timeoutMs ?? PROBE_TIMEOUT_MS,
+            });
             // The whole answer, not just `matched`: the counting fields are what make
             // the observe-only period readable (segmented.md R-OUT-10), and an older
             // server simply sends none of them (R-COMPAT-2).
-            const b = body && typeof body === "object" ? body : {};
+            const b = answer && typeof answer === "object" ? answer : {};
             return {
                 matched: b.matched ?? null,
                 stepHit: b.stepHit ?? null,
@@ -112,18 +498,45 @@ export class RemoteRecorder {
             };
         }
         catch (err) {
-            logLine("replay.intent_match_failed", { error: errText(err), why: "treated as a miss" });
+            if (err instanceof ServiceError && err.status === 404) {
+                // An older service: asking again on the next tool call gets the same 404.
+                this.matchIntentOffUntil = Date.now() + MATCH_INTENT_UNSUPPORTED_MS;
+            }
+            if (!opts.signal?.aborted) {
+                // Once per 30 s, not once per tool call: an outage is one fact.
+                logEvery("recorder.intent_match_failed", 30_000, "replay.intent_match_failed", {
+                    error: errText(err),
+                    why: "treated as a miss",
+                });
+            }
             return null;
         }
     }
-    /** Await the similar-prompt match for a run's create call (null = fresh run). */
+    /**
+     * The similar-prompt match for a run's create call (null = fresh run). Like
+     * {@link runCreated}, answers null at once while the service is cooling down,
+     * and as soon as the create's first attempt fails — the first prompt of an
+     * outage is not held for the retry's sleep (up to 2 s behind a Retry-After).
+     */
     async getMatch(runId) {
-        const pending = this.matches.get(runId);
-        return pending ? await pending : null;
+        const entry = this.runs.get(runId);
+        if (!entry)
+            return null;
+        entry.lastUsed = Date.now();
+        if (entry.settled)
+            return entry.settled.match;
+        if (entry.released || !entry.hot || !this.mayHotWait())
+            return null;
+        await entry.hot;
+        return entry.settled?.match ?? null;
     }
     recordToolSelected(runId, stepIndex, data) {
         const id = "step_" + randomUUID();
-        this.enqueue(runId, () => 
+        const toolInput = pend(data.toolInput, DEFAULT_MAX_PAYLOAD_BYTES, true);
+        const context = pend(data.context, TEXT_CAPS.context);
+        const intentText = data.intent ? pend(data.intent.text, TEXT_CAPS.intent) : undefined;
+        const intentSource = data.intent?.source;
+        this.enqueueRun(runId, "step", sizeOf(toolInput, context, intentText), () => 
         // `intent` and `metadata` are omitted, not nulled, when absent, so an
         // older service sees the body it has always seen (segmented.md
         // R-COMPAT-1).
@@ -132,42 +545,49 @@ export class RemoteRecorder {
             stepIndex,
             type: "tool_selected",
             toolName: data.toolName,
-            toolInput: data.toolInput,
-            context: data.context,
-            intent: data.intent,
+            toolInput: out(toolInput),
+            context: out(context),
+            intent: intentSource ? { text: out(intentText) ?? "", source: intentSource } : undefined,
             metadata: data.metadata,
         }));
         return id;
     }
     recordToolResponse(runId, stepIndex, data) {
         const id = "step_" + randomUUID();
-        this.enqueue(runId, () => this.post(`/recordings/runs/${runId}/steps`, {
+        const toolOutput = pend(data.toolOutput, DEFAULT_MAX_PAYLOAD_BYTES, true);
+        const toolError = pendError(data.toolError);
+        this.enqueueRun(runId, "step", sizeOf(toolOutput, toolError), () => this.post(`/recordings/runs/${runId}/steps`, {
             id,
             stepIndex,
             type: "tool_response",
             toolName: data.toolName,
-            toolOutput: data.toolOutput,
-            toolError: data.toolError,
+            toolOutput: out(toolOutput),
+            toolError: out(toolError),
         }));
         return id;
     }
     recordFinalAnswer(runId, stepIndex, data) {
         const id = "step_" + randomUUID();
-        this.enqueue(runId, () => this.post(`/recordings/runs/${runId}/steps`, {
+        const answer = pend(data.answer, TEXT_CAPS.answer);
+        this.enqueueRun(runId, "step", sizeOf(answer), () => this.post(`/recordings/runs/${runId}/steps`, {
             id,
             stepIndex,
             type: "final_answer",
-            answer: data.answer,
+            answer: out(answer),
         }));
         return id;
     }
     /** Backfill a step's `context` (the model's reasoning) after the fact. */
     backfillContext(runId, stepId, context) {
-        this.enqueue(runId, () => this.patch(`/recordings/runs/${runId}/steps/${stepId}`, { context }));
+        const text = pend(context, TEXT_CAPS.context);
+        this.enqueueRun(runId, "patch", sizeOf(text), () => 
+        // A PATCH that sets one field: repeating it is harmless.
+        this.send("PATCH", `/recordings/runs/${runId}/steps/${stepId}`, { context: out(text) }));
     }
     finishRun(runId, finalOutput, metrics) {
-        this.enqueue(runId, () => this.post(`/recordings/runs/${runId}/finish`, {
-            finalOutput,
+        const output = pend(finalOutput, TEXT_CAPS.answer);
+        this.enqueueRun(runId, "finish", sizeOf(output), () => this.post(`/recordings/runs/${runId}/finish`, {
+            finalOutput: out(output),
             originalCostUsd: metrics?.costUsd,
             originalMs: metrics?.durationMs,
         }));
@@ -175,140 +595,847 @@ export class RemoteRecorder {
     /**
      * Report what a matched turn cost (docs/calculatedReplay.md §11.2).
      *
-     * Queued on the run's own chain so it lands after that run's last step and so
-     * `flush` waits for it — a report is the last thing a matched turn produces.
-     * Best-effort like everything else here: an unredeemed ticket leaves no
-     * execution row at all, which loses a saving but can never invent one.
+     * Queued on the executions lane — a matched turn has no run on the service —
+     * so `flush` waits for it. Best-effort like everything else here: an
+     * unredeemed ticket leaves no execution row at all, which loses a saving but
+     * can never invent one.
      *
      * A doubled report (a retry, `Stop` racing `SessionEnd`) is safe by
      * construction: the ticket *is* the row's id, so the service books once and
-     * answers `200 { duplicate: true }`.
+     * answers `200 { duplicate: true }`. That is also why a report *with* a
+     * ticket is the one kind retried after an ambiguous failure.
      */
     reportExecution(report) {
         const costUsd = report.deriveCostUsd + report.sessionCostUsd + report.fallbackCostUsd;
-        this.enqueue(this.executionChainKey, async () => {
-            const body = await this.post(`/scenarios/${report.scenarioId}/executions`, {
-                ticket: report.ticket,
-                outcome: report.outcome,
-                costUsd,
-                deriveCostUsd: report.deriveCostUsd,
-                sessionCostUsd: report.sessionCostUsd,
-                fallbackCostUsd: report.fallbackCostUsd,
-                durationMs: report.durationMs,
-                stepsPlanned: report.stepsPlanned,
-                stepsPinned: report.stepsPinned,
-                measured: report.measured,
-                pricingVersion: report.pricingVersion,
-                prompt: report.prompt,
-                // Per-step verdicts and the headline failure (errorshandling.md). All
-                // optional on the service side, so an older service ignores them rather
-                // than rejecting the report — and the costs still book.
-                steps: report.steps,
-                error: report.error,
-                errorStage: report.errorStage,
-                errorStepIndex: report.errorStepIndex,
-                errorToolName: report.errorToolName,
-                fallbackStepIndex: report.fallbackStepIndex,
-                fallbackKind: report.fallbackKind,
-                baselineEligible: report.baselineEligible,
-                sharedWith: report.sharedWith,
-                // Why nothing ran, when nothing ran. Additive: an older service drops
-                // the field and books the cost exactly as it always did.
-                declined: report.declined,
+        const prompt = pend(report.prompt, TEXT_CAPS.prompt);
+        const error = pend(report.error, TEXT_CAPS.reportError);
+        this.enqueue({
+            lane: EXECUTIONS,
+            kind: "report",
+            bytes: sizeOf(prompt, error) + 1024,
+            send: async () => {
+                const body = await this.request("POST", `/scenarios/${report.scenarioId}/executions`, JSON.stringify({
+                    ticket: report.ticket,
+                    outcome: report.outcome,
+                    costUsd,
+                    deriveCostUsd: report.deriveCostUsd,
+                    sessionCostUsd: report.sessionCostUsd,
+                    fallbackCostUsd: report.fallbackCostUsd,
+                    durationMs: report.durationMs,
+                    stepsPlanned: report.stepsPlanned,
+                    stepsPinned: report.stepsPinned,
+                    measured: report.measured,
+                    pricingVersion: report.pricingVersion,
+                    prompt: out(prompt),
+                    // Per-step verdicts and the headline failure (errorshandling.md). All
+                    // optional on the service side, so an older service ignores them rather
+                    // than rejecting the report — and the costs still book. Errors are
+                    // shown on a web page, so they are capped and redacted like any text.
+                    steps: report.steps?.map((s) => typeof s.error === "string" ? { ...s, error: capText(s.error, TEXT_CAPS.reportError, redactText) } : s),
+                    error: out(error),
+                    errorStage: report.errorStage,
+                    errorStepIndex: report.errorStepIndex,
+                    errorToolName: report.errorToolName,
+                    fallbackStepIndex: report.fallbackStepIndex,
+                    fallbackKind: report.fallbackKind,
+                    baselineEligible: report.baselineEligible,
+                    sharedWith: report.sharedWith,
+                    // Why nothing ran, when nothing ran. Additive: an older service drops
+                    // the field and books the cost exactly as it always did.
+                    declined: report.declined,
+                }), { retryTransient: Boolean(report.ticket) });
+                const r = (body ?? {});
+                const failed = report.steps?.filter((s) => s.status === "failed").length ?? 0;
+                logLine("execution.reported", {
+                    run: report.runId,
+                    scenario: report.scenarioId,
+                    ticket: report.ticket,
+                    outcome: report.outcome,
+                    derive: report.deriveCostUsd.toFixed(4),
+                    session: report.sessionCostUsd.toFixed(4),
+                    fallback: report.fallbackCostUsd.toFixed(4),
+                    savedUsd: r.savedUsd ?? undefined,
+                    duplicate: r.duplicate ? true : undefined,
+                    measured: report.measured,
+                    steps: report.steps?.length,
+                    stepsFailed: failed || undefined,
+                    baselineEligible: report.baselineEligible === false ? false : undefined,
+                    sharedWith: report.sharedWith?.length,
+                    declined: report.declined,
+                });
+            },
+        });
+    }
+    /**
+     * Await every queued send for a run, including its execution report — for at
+     * most `opts.timeoutMs` (default {@link DEFAULT_FLUSH_TIMEOUT_MS}, or
+     * `BIR_FLUSH_TIMEOUT_MS`), and not at all while the service is cooling down.
+     * Either way the sends carry on in the background; a flush behind a dead
+     * service must never be what holds a hook or a shutdown.
+     *
+     * WHY THE BREAKER ENDS THE WAIT. In the common outages — offline, refused,
+     * a 5xx — the first send fails in milliseconds and opens the breaker, and
+     * every job after it sleeps out the cool-down before it tries (the service
+     * is not hammered). A flush that waited for those sleeps paid its whole
+     * deadline on every turn of the outage, where the old fail-at-once chain
+     * paid tens of milliseconds. Nothing a cooling-down lane holds can land
+     * sooner than the cool-down, so the flush stops waiting the moment the
+     * breaker opens.
+     */
+    async flush(runId, opts = {}) {
+        const timeoutMs = opts.timeoutMs ?? positiveEnv("BIR_FLUSH_TIMEOUT_MS", DEFAULT_FLUSH_TIMEOUT_MS);
+        const outcome = await this.waitForLanes([runId, EXECUTIONS], timeoutMs);
+        const entry = this.runs.get(runId);
+        // The match holds the whole scenario; nobody asks for it after a flush.
+        if (entry?.settled?.match)
+            entry.settled = { match: null, created: entry.settled.created };
+        if (outcome === "timeout") {
+            logLine("recorder.flush_incomplete", {
+                run: runId,
+                pending: this.pendingSends,
+                why: "the service is slow or down — the rest is sent in the background, or dropped past the backlog bound",
             });
-            const r = (body ?? {});
-            const failed = report.steps?.filter((s) => s.status === "failed").length ?? 0;
-            logLine("execution.reported", {
-                run: report.runId,
-                scenario: report.scenarioId,
-                ticket: report.ticket,
-                outcome: report.outcome,
-                derive: report.deriveCostUsd.toFixed(4),
-                session: report.sessionCostUsd.toFixed(4),
-                fallback: report.fallbackCostUsd.toFixed(4),
-                savedUsd: r.savedUsd ?? undefined,
-                duplicate: r.duplicate ? true : undefined,
-                measured: report.measured,
-                steps: report.steps?.length,
-                stepsFailed: failed || undefined,
-                baselineEligible: report.baselineEligible === false ? false : undefined,
-                sharedWith: report.sharedWith?.length,
-                declined: report.declined,
+        }
+        else if (outcome === "cooling") {
+            // Once per 30 s: an outage is one fact, not one line per turn.
+            logEvery("recorder.flush_deferred", 30_000, "recorder.flush_deferred", {
+                run: runId,
+                pending: this.pendingSends,
+                why: "the service is cooling down after a failure — nothing waits on it; the rest is sent in the background once it answers",
             });
+        }
+    }
+    // ── lanes ────────────────────────────────────────────────────────────────
+    newEntry() {
+        let resolveHot;
+        let resolveCreated;
+        const entry = {
+            userId: this.session.user.id,
+            hot: new Promise((r) => {
+                resolveHot = r;
+            }),
+            created: new Promise((r) => {
+                resolveCreated = r;
+            }),
+            settle: (match, created) => {
+                if (entry.settled)
+                    return;
+                entry.settled = { match, created };
+                entry.settledAt = Date.now();
+                resolveHot();
+                resolveCreated(created);
+                // Callers that are waiting hold the promises themselves.
+                entry.hot = undefined;
+                entry.created = undefined;
+            },
+            release: () => {
+                if (entry.settled || entry.released)
+                    return;
+                entry.released = true;
+                entry.hot = undefined;
+                resolveHot();
+            },
+            lastUsed: Date.now(),
+            failed: 0,
+            dropped: 0,
+        };
+        return entry;
+    }
+    /** The entry for a run, made on first sight for an id this recorder did not open. */
+    entryFor(runId) {
+        let entry = this.runs.get(runId);
+        if (!entry) {
+            entry = this.newEntry();
+            entry.settle(null, { created: true });
+            this.runs.set(runId, entry);
+        }
+        entry.lastUsed = Date.now();
+        return entry;
+    }
+    enqueueRun(runId, kind, bytes, send) {
+        this.entryFor(runId);
+        this.enqueue({
+            lane: runId,
+            runId,
+            kind,
+            bytes,
+            send: async () => {
+                await send();
+            },
         });
     }
-    /** Await every queued send for a run, including its execution report. */
-    async flush(runId) {
-        await (this.chains.get(runId) ?? Promise.resolve());
-        this.chains.delete(runId);
-        this.matches.delete(runId);
-        this.created.delete(runId);
-        // Reports live on their own chain (a matched run has no run chain of its own
-        // — the service created no run), so draining that chain is a separate step.
-        await (this.chains.get(this.executionChainKey) ?? Promise.resolve());
-    }
-    // ── internals ────────────────────────────────────────────────────────────
-    /** Append to this run's ordered chain; failures are logged, not thrown. */
-    enqueue(runId, fn) {
-        const prev = this.chains.get(runId) ?? Promise.resolve();
-        const next = prev.then(fn).catch((err) => {
-            // A dropped send means this run's recording is incomplete — something an
-            // auditor has to be able to see, so it is never verbose-only.
-            logLine("recorder.send_failed", {
-                run: runId,
+    /** Append to a lane. Synchronous and never throws; the lane drains after the caller returns. */
+    enqueue(spec) {
+        const run = spec.runId ? this.runs.get(spec.runId) : undefined;
+        const job = { ...spec, seq: ++this.seq, userId: run?.userId ?? this.session.user.id };
+        if (this.state !== "recording")
+            return this.retire(job, run, this.state);
+        if (run?.dead)
+            return this.retire(job, run, run.dead);
+        let lane = this.lanes.get(job.lane);
+        if (!lane) {
+            lane = { jobs: [], running: false, waiters: [] };
+            this.lanes.set(job.lane, lane);
+        }
+        lane.jobs.push(job);
+        this.pendingSends += 1;
+        this.pendingBytes += job.bytes;
+        this.enforceBound();
+        if (!lane.running) {
+            lane.running = true;
+            const started = lane;
+            // Next turn of the event loop: redaction and serialization happen off
+            // the hook's own path, after its answer is on the wire.
+            setImmediate(() => void this.drain(job.lane, started));
+        }
+    }
+    async drain(key, lane) {
+        try {
+            for (;;) {
+                const job = lane.jobs.shift();
+                if (!job)
+                    break;
+                this.pendingSends -= 1;
+                this.pendingBytes -= job.bytes;
+                this.noteBacklogRecovered();
+                await this.execute(job);
+            }
+        }
+        catch {
+            /* execute never throws; belt and braces for the lane's own bookkeeping */
+        }
+        finally {
+            if (lane.jobs.length > 0) {
+                setImmediate(() => void this.drain(key, lane));
+            }
+            else {
+                lane.running = false;
+                if (this.lanes.get(key) === lane)
+                    this.lanes.delete(key);
+                for (const resolve of lane.waiters.splice(0))
+                    resolve();
+            }
+        }
+    }
+    laneIsIdle(key) {
+        const lane = this.lanes.get(key);
+        return !lane || (!lane.running && lane.jobs.length === 0);
+    }
+    /**
+     * Wait until every lane in `keys` is idle, the breaker opens ("cooling"), or
+     * `timeoutMs` passes — whichever is first. The breaker is polled (every
+     * {@link FLUSH_POLL_MS}) rather than subscribed to: the verdict is shared by
+     * the whole process and has no listeners, and a poll only runs while a flush
+     * is actually waiting.
+     */
+    waitForLanes(keys, timeoutMs) {
+        if (keys.every((k) => this.laneIsIdle(k)))
+            return Promise.resolve("idle");
+        if (!this.health.canWait())
+            return Promise.resolve("cooling");
+        return new Promise((resolve) => {
+            const cancels = [];
+            let settled = false;
+            const finish = (outcome) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(deadline);
+                clearInterval(poll);
+                for (const cancel of cancels)
+                    cancel();
+                resolve(outcome);
+            };
+            // Not unref'd: a caller awaiting this must get its answer even when the
+            // only other thing left is a lane asleep in an unref'd cool-down.
+            const deadline = setTimeout(() => finish("timeout"), Math.max(0, timeoutMs));
+            const poll = setInterval(() => {
+                if (!this.health.canWait())
+                    finish("cooling");
+            }, FLUSH_POLL_MS);
+            let left = keys.length;
+            for (const key of keys) {
+                const lane = this.lanes.get(key);
+                if (!lane || (!lane.running && lane.jobs.length === 0)) {
+                    left -= 1;
+                    continue;
+                }
+                const waiter = () => {
+                    left -= 1;
+                    if (left === 0)
+                        finish("idle");
+                };
+                lane.waiters.push(waiter);
+                cancels.push(() => {
+                    const i = lane.waiters.indexOf(waiter);
+                    if (i >= 0)
+                        lane.waiters.splice(i, 1);
+                });
+            }
+            if (left === 0)
+                finish("idle");
+        });
+    }
+    /** Run one job: decide whether it may still go, wait out a cool-down, send. Never throws. */
+    async execute(job) {
+        const run = job.runId ? this.runs.get(job.runId) : undefined;
+        let endProbe;
+        try {
+            let why = await this.whyNotSend(job, run);
+            if (why)
+                return this.retire(job, run, why);
+            // Don't hammer a service that just failed: wait out its cool-down, and
+            // then let one send (maybe this one) find out whether it came back.
+            const wait = await this.waitForService();
+            endProbe = wait.endProbe;
+            if (wait.giveUp) {
+                this.retire(job, run, "service_down");
+                // Without its create the rest of the run would 404.
+                if (job.kind === "create" && run && job.runId)
+                    this.markDead(job.runId, run, "service_down");
+                return;
+            }
+            await this.refreshAhead();
+            // Both can take a while (a minute of cool-down, a refresh), and a hook
+            // may have signed another account in meanwhile: ask again, or a run
+            // opened under one account would go out under the next one's token.
+            why = await this.whyNotSend(job, run);
+            if (why)
+                return this.retire(job, run, why);
+            await job.send();
+            if (job.kind === "finish" && run && job.runId)
+                this.summarize(job.runId, run);
+        }
+        catch (err) {
+            if (err instanceof AccountChanged) {
+                this.retire(job, run, this.accountChanged(job, run));
+                return;
+            }
+            this.onSendFailed(job, run, err);
+            if (job.kind === "finish" && run && job.runId)
+                this.summarize(job.runId, run);
+        }
+        finally {
+            endProbe?.();
+        }
+    }
+    async whyNotSend(job, run) {
+        this.checkCredentials();
+        if (this.state !== "recording")
+            return this.state;
+        if (job.userId !== undefined && job.userId !== this.session.user.id)
+            return this.accountChanged(job, run);
+        if (!run || !job.runId)
+            return undefined;
+        if (run.userId !== this.session.user.id)
+            this.markDead(job.runId, run, "account_changed");
+        if (run.dead)
+            return run.dead;
+        if (job.kind !== "create") {
+            // The create went first on this lane, so this is already settled — unless
+            // it is still being retried, which is worth the wait.
+            const created = run.settled?.created ?? (run.created ? await run.created : { created: true });
+            if (!created.created) {
+                this.markDead(job.runId, run, "not_created");
+                return "not_created";
+            }
+            if (run.dead)
+                return run.dead;
+        }
+        return undefined;
+    }
+    /**
+     * A job queued under one account, about to go out after another signed in:
+     * its run is closed (the rest would split it across accounts), and a report
+     * is dropped with a line. Returns the reason to retire it with.
+     */
+    accountChanged(job, run) {
+        if (run && job.runId) {
+            this.markDead(job.runId, run, "account_changed");
+        }
+        else {
+            logEvery("recorder.report_dropped", 30_000, "recorder.report_dropped", {
+                why: "another account signed in on this machine before it was sent — it is not sent under that one",
+            });
+        }
+        return "account_changed";
+    }
+    /** A job leaves without being sent: counted (unless it was never meant to go), and a create settles. */
+    retire(job, run, why) {
+        try {
+            job.abandon?.();
+        }
+        catch {
+            /* never */
+        }
+        // A matched turn records nothing by design: nothing was lost.
+        if (why !== "not_created") {
+            this.droppedSends += 1;
+            if (run)
+                run.dropped += 1;
+        }
+        if (job.kind === "finish" && run && job.runId)
+            this.summarize(job.runId, run);
+    }
+    /** Skip everything left for a run, once: its sends would all fail the same way. */
+    markDead(runId, run, why) {
+        if (run.dead)
+            return;
+        run.dead = why;
+        const lane = this.lanes.get(runId);
+        if (lane && lane.jobs.length > 0) {
+            const jobs = lane.jobs;
+            lane.jobs = [];
+            for (const job of jobs) {
+                this.pendingSends -= 1;
+                this.pendingBytes -= job.bytes;
+                this.retire(job, run, why);
+            }
+        }
+        if (why === "not_created") {
+            logDetail("recorder.run_not_created", { run: runId, why: "the service matched the prompt and kept its own run" });
+        }
+        else if (!(why in PAUSE_WHY)) {
+            logLine("recorder.run_abandoned", { run: runId, reason: why, why: DEAD_WHY[why] ?? why });
+        }
+    }
+    onSendFailed(job, run, err) {
+        this.failedSends += 1;
+        const status = err instanceof ServiceError ? err.status : undefined;
+        if (run && job.runId) {
+            run.failed += 1;
+            if (job.kind === "create") {
+                // A definite refusal means there is no run; an ambiguous failure (a
+                // timeout, a 5xx) may have created it, and the first step will say.
+                if (status !== undefined && status >= 400 && status < 500 && ![401, 408, 409, 429].includes(status)) {
+                    this.markDead(job.runId, run, "create_rejected");
+                }
+            }
+            else if (status === 404) {
+                this.markDead(job.runId, run, "not_found");
+            }
+            // One line per run, not per step: an outage is one fact, and the count
+            // arrives with the run's finish (recorder.run_incomplete).
+            if (run.failed === 1) {
+                logLine("recorder.send_failed", {
+                    run: job.runId,
+                    why: "this run's recording is incomplete",
+                    error: errText(err),
+                });
+            }
+        }
+        else {
+            logEvery(`recorder.send_failed:${job.lane}`, 30_000, "recorder.send_failed", {
+                run: job.lane,
                 why: "this run's recording is incomplete",
                 error: errText(err),
             });
+        }
+    }
+    /** At a run's finish: say what did not arrive, if anything did not. */
+    summarize(runId, run) {
+        if (run.failed <= 1 && run.dropped === 0)
+            return;
+        logLine("recorder.run_incomplete", {
+            run: runId,
+            failed: run.failed || undefined,
+            dropped: run.dropped || undefined,
+            reason: run.dead,
+            why: "some of this run's steps never reached the service",
         });
-        this.chains.set(runId, next);
     }
-    post(path, body) {
-        return this.send("POST", path, body);
+    /** Keep the backlog inside its bound: drop the oldest unsent step first. */
+    enforceBound() {
+        while (this.pendingSends > this.maxPendingSends || this.pendingBytes > this.maxPendingBytes) {
+            const victim = this.pickVictim();
+            if (!victim)
+                return;
+            const lane = this.lanes.get(victim.lane);
+            const index = lane ? lane.jobs.indexOf(victim) : -1;
+            if (!lane || index < 0)
+                return;
+            lane.jobs.splice(index, 1);
+            this.pendingSends -= 1;
+            this.pendingBytes -= victim.bytes;
+            this.droppedWhileFull += 1;
+            if (!this.backlogFull) {
+                this.backlogFull = true;
+                logLine("recorder.backlog_full", {
+                    pending: this.pendingSends,
+                    bytes: this.pendingBytes,
+                    why: "the service is not keeping up — the oldest unsent steps are dropped, so those runs are incomplete",
+                });
+            }
+            const run = victim.runId ? this.runs.get(victim.runId) : undefined;
+            this.retire(victim, run, "dropped");
+            // Without its create the rest of the run would 404.
+            if (victim.kind === "create" && run && victim.runId)
+                this.markDead(victim.runId, run, "dropped");
+        }
     }
-    patch(path, body) {
-        return this.send("PATCH", path, body);
+    /**
+     * The oldest unsent step or patch; failing that, the oldest job of any kind.
+     * Steps first because a run without its middle is still a run, and one
+     * without its create or finish is a run the service can never close.
+     */
+    pickVictim() {
+        let best;
+        for (const lane of this.lanes.values()) {
+            for (const job of lane.jobs) {
+                if (job.kind === "step" || job.kind === "patch") {
+                    if (!best || job.seq < best.seq)
+                        best = job;
+                    break; // lanes are FIFO: the first is the oldest
+                }
+            }
+        }
+        if (best)
+            return best;
+        for (const lane of this.lanes.values()) {
+            const first = lane.jobs[0];
+            if (first && (!best || first.seq < best.seq))
+                best = first;
+        }
+        return best;
     }
-    async send(method, path, body, retried = false) {
-        const res = await fetch(`${this.baseUrl}${path}`, {
-            method,
-            headers: {
-                "content-type": "application/json",
-                authorization: `Bearer ${this.session.accessToken}`,
-            },
-            body: JSON.stringify(body),
-        });
-        if (res.status === 401 && !retried) {
-            await this.refresh();
-            return this.send(method, path, body, true);
+    noteBacklogRecovered() {
+        if (!this.backlogFull)
+            return;
+        if (this.pendingSends > this.maxPendingSends / 2 || this.pendingBytes > this.maxPendingBytes / 2)
+            return;
+        this.backlogFull = false;
+        logLine("recorder.backlog_recovered", { dropped: this.droppedWhileFull });
+        this.droppedWhileFull = 0;
+    }
+    /** Forget runs nobody will ask about again, and release matches past their TTL. */
+    sweep() {
+        const now = Date.now();
+        if (now - this.lastSweep < 60_000 && this.runs.size <= RUN_STATE_MAX)
+            return;
+        this.lastSweep = now;
+        for (const [id, entry] of this.runs) {
+            if (this.lanes.has(id))
+                continue;
+            if (entry.settled?.match && entry.settledAt !== undefined && now - entry.settledAt > MATCH_TTL_MS) {
+                entry.settled = { match: null, created: entry.settled.created };
+            }
+            if (entry.settled && now - entry.lastUsed > RUN_STATE_TTL_MS)
+                this.runs.delete(id);
         }
-        const text = await res.text().catch(() => "");
-        if (!res.ok) {
-            throw new Error(`HTTP ${res.status} ${method} ${path}${text ? ` — ${text}` : ""}`);
+        if (this.runs.size > RUN_STATE_MAX) {
+            for (const [id, entry] of this.runs) {
+                if (this.runs.size <= RUN_STATE_MAX)
+                    break;
+                if (!this.lanes.has(id) && entry.settled)
+                    this.runs.delete(id);
+            }
         }
-        if (!text)
-            return undefined;
+    }
+    // ── the service ──────────────────────────────────────────────────────────
+    /** The breaker is closed: no failure since the last answer. */
+    healthyNow() {
+        return this.health.canWait() && this.health.snapshot().consecutiveFailures === 0;
+    }
+    /**
+     * May a hook wait on the service right now? Only when it is known to be
+     * answering. A hook is never the half-open probe: once the cool-down ends a
+     * background `GET /health` (or a queued send) finds out, and the next hook
+     * waits again.
+     */
+    mayHotWait() {
+        this.checkCredentials();
+        if (this.state !== "recording")
+            return false;
+        if (this.healthyNow())
+            return true;
+        this.probeSoon();
+        return false;
+    }
+    probeSoon() {
+        if (this.probeInFlight() || !this.health.canWait())
+            return;
+        const end = this.beginProbe();
+        this.request("GET", "/health", undefined, { timeoutMs: PROBE_TIMEOUT_MS, anonymous: true })
+            .catch(() => undefined)
+            .finally(end);
+    }
+    /** Take the half-open slot. The returned function gives it back, once. */
+    beginProbe() {
+        let resolve;
+        const flight = { done: new Promise((r) => (resolve = r)), startedAt: Date.now() };
+        this.probe = flight;
+        return () => {
+            if (this.probe === flight)
+                this.probe = undefined;
+            resolve();
+        };
+    }
+    /**
+     * Is a probe out? One older than any request could take (every attempt has
+     * a deadline) is a slot somebody failed to give back, and is not honoured.
+     */
+    probeInFlight() {
+        const p = this.probe;
+        if (!p)
+            return false;
+        if (Date.now() - p.startedAt > 4 * serviceTimeoutMs() + PROBE_TIMEOUT_MS) {
+            this.probe = undefined;
+            return false;
+        }
+        return true;
+    }
+    /** Lanes let go after a successful probe spread over a fraction of the cool-down (at most 2 s). */
+    releaseJitterMs() {
+        const spread = Math.min(RELEASE_JITTER_MAX_MS, Math.floor(this.health.baseCooldown / 2));
+        return Math.floor(Math.random() * Math.max(0, spread));
+    }
+    /**
+     * Wait until a background send may go.
+     *
+     * - The breaker is closed: go at once.
+     * - It is cooling down: sleep until it ends. A send that has waited
+     *   {@link COOLDOWN_WAIT_MAX_MS} and still faces more than
+     *   {@link COOLDOWN_GRACE_MS} of it is given up (`giveUp`), unsent.
+     * - It is half-open: ONE lane takes the probe slot and goes (`endProbe`
+     *   gives the slot back once its send settles); every other lane waits for
+     *   that verdict. A success lets them go, each after its own short random
+     *   pause; a failure starts a longer cool-down, and they wait that out.
+     *
+     * Before this, every lane with a queued send woke at the same moment and
+     * sent into the dead service together, once per cool-down.
+     */
+    async waitForService() {
+        const started = Date.now();
+        let waited = false;
+        for (;;) {
+            if (this.state !== "recording")
+                return {};
+            if (this.healthyNow()) {
+                if (!waited)
+                    return {};
+                // It came back while this lane waited: follow the probe a moment
+                // later, not together with every other lane.
+                waited = false;
+                await sleep(this.releaseJitterMs(), true);
+                continue;
+            }
+            waited = true;
+            if (this.health.canWait()) {
+                if (!this.probeInFlight())
+                    return { endProbe: this.beginProbe() };
+                await Promise.race([this.probe?.done, sleep(PROBE_POLL_MS, true)]);
+                continue;
+            }
+            const left = this.cooldownWaitMaxMs - (Date.now() - started);
+            const cooling = (this.health.snapshot().openUntil ?? 0) - Date.now();
+            if (left <= 0 && cooling > Math.min(COOLDOWN_GRACE_MS, this.cooldownWaitMaxMs / 12))
+                return { giveUp: true };
+            // Past the bound, only a cool-down about to end is still waited out.
+            await sleep(Math.min(Math.max(cooling, 25), left > 0 ? left : Number.POSITIVE_INFINITY, 5_000), true);
+        }
+    }
+    /** Renew the access token shortly before it expires — in a lane, never on a hook. */
+    async refreshAhead() {
+        if (this.session.accessExpiresAt - REFRESH_AHEAD_MS > Date.now())
+            return;
+        if (Date.now() - this.lastAheadAttempt < REFRESH_AHEAD_RETRY_MS)
+            return;
+        this.lastAheadAttempt = Date.now();
         try {
-            return JSON.parse(text);
+            await this.refreshSingleFlight();
         }
         catch {
-            return undefined;
+            /* the send meets its 401 and says so */
+        }
+    }
+    post(path, body) {
+        return this.send("POST", path, body);
+    }
+    /** A background send: every lane job is safe to repeat once (client ids, a PATCH, a ticket). */
+    send(method, path, body) {
+        return this.request(method, path, JSON.stringify(body), { retryTransient: true });
+    }
+    /**
+     * One request, with a deadline, reported to the health verdict, with the
+     * one-refresh-on-401 rule and — for background sends — one retry after a
+     * transient failure.
+     *
+     * WHICH FAILURES ARE RETRIED. Only those that prove the service did not take
+     * the request: a connection that never happened or a pooled socket the load
+     * balancer had already closed ({@link SAFE_RETRY_CODES}), and a 429 or 503.
+     * Not a 502/504 or a reset mid-request — the origin may have the first
+     * attempt — not a timeout (a hung service would just cost another deadline)
+     * and not while the service is already failing (the breaker's cool-down is
+     * the retry then). Every background body carries a client-generated id — the
+     * run, the step, the execution ticket — or is a PATCH of one field, so even
+     * a repeat whose first attempt did land is recognisable; a 409 on the retry
+     * is taken as that.
+     *
+     * THE ACCOUNT IS FIXED FOR THE REQUEST. A retry or a refresh leaves the event
+     * loop, and a hook may sign another account in meanwhile; the next attempt
+     * then goes nowhere ({@link AccountChanged}) instead of out under that
+     * account's token.
+     *
+     * EVERY ANSWER SAYS WHEN ITS ATTEMPT WAS SENT. `health.ok(started)`: the late
+     * answer of an attempt a hook already gave up on (`slow`) must not end the
+     * cool-down that overrun started.
+     *
+     * `onRetry` runs when the first attempt failed and a retry is about to
+     * sleep: whoever waits on this answer on a hook's behalf can stop now.
+     */
+    async request(method, path, body, opts = {}) {
+        let retried401 = false;
+        let retriedTransient = false;
+        const user = this.session.user.id;
+        for (let attempt = 0;; attempt++) {
+            if (attempt > 0 && !opts.anonymous && this.session.user.id !== user) {
+                throw new AccountChanged(`${method} ${path}`);
+            }
+            const token = this.session.accessToken;
+            const timeoutMs = opts.timeoutMs ?? serviceTimeoutMs();
+            const signal = timeoutSignal(timeoutMs, opts.signal);
+            const started = this.health.stamp();
+            let res;
+            try {
+                res = await fetch(`${this.baseUrl}${path}`, {
+                    method,
+                    headers: {
+                        ...(body !== undefined ? { "content-type": "application/json" } : {}),
+                        ...(opts.anonymous ? {} : { authorization: `Bearer ${token}` }),
+                    },
+                    body,
+                    signal,
+                });
+            }
+            catch (err) {
+                if (opts.signal?.aborted)
+                    throw err; // the caller stopped waiting; says nothing about the service
+                const timedOut = signal.aborted;
+                const reason = timedOut ? `timed out after ${timeoutMs} ms` : reasonOf(err);
+                const safe = !timedOut && SAFE_RETRY_CODES.has(causeCode(err) ?? "");
+                if (safe && opts.retryTransient && !retriedTransient && this.healthyNow()) {
+                    retriedTransient = true;
+                    notify(opts.onRetry);
+                    await sleep(jitterMs());
+                    continue;
+                }
+                this.health.fail(reason);
+                throw new ServiceError(`${method} ${path}: ${reason}`);
+            }
+            if (res.status === 401 && !opts.anonymous) {
+                // Release the socket now rather than at GC, then renew — once.
+                await res.body?.cancel().catch(() => undefined);
+                this.health.ok(started);
+                if (retried401)
+                    throw new ServiceError(`HTTP 401 ${method} ${path}`, 401);
+                retried401 = true;
+                // Another send (or a sibling process) already renewed the token this
+                // one used: just resend with the new one. The wait for a renewal is
+                // held to this attempt's own deadline — a probe's caller is a hook.
+                if (this.session.accessToken === token) {
+                    try {
+                        await untilAborted(this.refreshSingleFlight(), signal);
+                    }
+                    catch (err) {
+                        if (opts.signal?.aborted || !signal.aborted)
+                            throw err;
+                        throw new ServiceError(`HTTP 401 ${method} ${path}: the token refresh outlasted ${timeoutMs} ms`, 401);
+                    }
+                }
+                if (this.state !== "recording")
+                    throw new ServiceError(`HTTP 401 ${method} ${path}`, 401);
+                continue;
+            }
+            const type = res.headers.get("content-type") ?? "";
+            let text;
+            try {
+                text = await res.text();
+            }
+            catch (err) {
+                if (opts.signal?.aborted)
+                    throw err;
+                const reason = signal.aborted ? `timed out after ${timeoutMs} ms reading the answer` : reasonOf(err);
+                this.health.fail(reason);
+                throw new ServiceError(`${method} ${path}: ${reason}`, res.status);
+            }
+            if (isUnhealthyStatus(res.status)) {
+                if (opts.retryTransient && !retriedTransient && RETRY_STATUSES.has(res.status) && this.healthyNow()) {
+                    retriedTransient = true;
+                    notify(opts.onRetry);
+                    await sleep(retryDelayMs(res));
+                    continue;
+                }
+                this.health.fail(`HTTP ${res.status}`);
+                throw new ServiceError(`HTTP ${res.status} ${method} ${path}${detail(text, type)}`, res.status);
+            }
+            // A 2xx web page is a captive portal or a website, and a 403 one a CDN's
+            // challenge — not the API answering. An empty or plain 2xx is: only the
+            // body decides, not a `text/html` a framework put on `res.send("ok")`.
+            if ((res.ok || res.status === 403) && isWebPage(text, type)) {
+                this.health.fail("html");
+                throw new ServiceError(`HTTP ${res.status} ${method} ${path} — the answer was a web page, not the BaseIn API`, res.status);
+            }
+            // Anything else is the service answering, including a 4xx — an older
+            // service's 404 must not look like an outage.
+            this.health.ok(started);
+            if (!res.ok) {
+                if (res.status === 409 && retriedTransient)
+                    return undefined; // the first attempt landed
+                throw new ServiceError(`HTTP ${res.status} ${method} ${path}${detail(text, type)}`, res.status);
+            }
+            if (!text)
+                return undefined;
+            try {
+                return JSON.parse(text);
+            }
+            catch {
+                return undefined;
+            }
         }
     }
+    // ── the session ──────────────────────────────────────────────────────────
+    /**
+     * Refresh once for everyone. Concurrent 401s — a run's create, an execution
+     * report and a probe crossing the expiry together — used to each spend the
+     * rotating refresh token; one won, the others were rejected and their sends
+     * (a create: the whole turn) were dropped.
+     */
+    refreshSingleFlight() {
+        if (!this.refreshing) {
+            this.refreshing = this.refresh().finally(() => {
+                this.refreshing = undefined;
+            });
+        }
+        return this.refreshing;
+    }
     /**
      * Adopt a newer session written by a sibling process, if there is one.
      *
      * Returns true when this recorder now holds a usable token it did not have to
-     * spend a refresh on.
+     * spend a refresh on. Only a session for the same service and the same
+     * account is adopted: the binding is what keeps a token from being sent to
+     * an address it was not issued for, and an account change is a run boundary
+     * ({@link checkCredentials}), never a mid-run swap.
      */
     adoptStoredSession() {
         const stored = loadCredentials();
         if (!stored)
             return false;
+        if (!issuedFor(stored, this.binding))
+            return false;
+        if (stored.user.id !== this.session.user.id)
+            return false;
         if (stored.accessToken === this.session.accessToken)
             return false;
-        if (stored.accessExpiresAt - 30_000 <= Date.now())
+        if (stored.accessExpiresAt - 30_000 <= Date.now()) {
+            // Expired, but its refresh token is newer than ours: spend that one.
+            if (stored.refreshToken !== this.session.refreshToken) {
+                this.session = { ...this.session, refreshToken: stored.refreshToken };
+            }
             return false;
-        this.session = stored;
+        }
+        this.session = { ...stored, authUrl: stored.authUrl ?? this.binding };
+        this.noteFileSeen();
         logLine("auth.adopted", { why: "another process had already refreshed" });
         return true;
     }
@@ -325,37 +1452,139 @@ export class RemoteRecorder {
      * The fix is to treat the credentials file as the shared source of truth:
      * check it before spending our token, and check it again if our refresh is
      * rejected, because the process that beat us has already written a good one.
+     * A rejection with nothing to adopt pauses the recorder (`auth_rejected`)
+     * instead of paying two round trips on every later send; a new sign-in
+     * resumes it, and so does a retry every {@link AUTH_REJECTED_RETRY_MS}.
+     *
+     * WHAT COUNTS AS A REJECTION. Only the service's own JSON 400/401 — the
+     * answer that says this refresh token is spent. A 403 or a web page (a CDN
+     * challenge, a portal) says nothing about the token, and pausing on one
+     * stopped recording for the rest of a daemon's life. And a rejection is
+     * believed only after one more look at the file ~{@link AUTH_RECHECK_MS}
+     * later: a sibling that rotated the token a moment ago may not have written
+     * it yet. Any other failure is not retried for {@link REFRESH_RETRY_MS}, so a
+     * refresh route that keeps failing costs one request per half minute, not
+     * one per send.
      */
     async refresh() {
         if (this.adoptStoredSession())
             return;
+        if (Date.now() < this.refreshRetryAt) {
+            throw new ServiceError("refresh failed moments ago — not tried again yet", 401);
+        }
+        const spent = this.session.refreshToken;
         try {
             await this.refreshOverNetwork();
+            this.refreshRetryAt = 0;
         }
         catch (err) {
             // Someone may have refreshed while we were failing to.
             if (this.adoptStoredSession())
                 return;
+            if (err instanceof RefreshRejected) {
+                await sleep(this.authRecheckMs, true);
+                if (this.adoptStoredSession())
+                    return;
+                // Adopted by a hook's credentials check while we waited, or signed
+                // out: either way this refusal is no longer the news.
+                if (this.session.refreshToken !== spent || this.state !== "recording")
+                    throw err;
+                this.rejectedAt = Date.now();
+                this.pause("auth_rejected");
+            }
+            else if (this.health.canWait()) {
+                // The service answered, just not with a session (a JSON 403, a 404):
+                // asking again on the next send would get the same. A failure that
+                // opened the breaker needs no hold of its own — the cool-down is it.
+                this.refreshRetryAt = Date.now() + REFRESH_RETRY_MS;
+            }
             throw err;
         }
     }
+    /**
+     * While `auth_rejected`, try the refresh again now and then, in the
+     * background: a refusal the service later takes back (a bad deploy, a
+     * clock), or one the recheck missed, must not need a `bir login` to end.
+     * Never awaited by the caller — a hook's credentials check starts it.
+     */
+    retryRejected() {
+        if (this.state !== "auth_rejected" || this.refreshing)
+            return;
+        if (Date.now() - this.rejectedAt < this.authRetryMs)
+            return;
+        this.rejectedAt = Date.now();
+        this.refreshRetryAt = 0;
+        this.refreshSingleFlight()
+            .then(() => {
+            if (this.state === "auth_rejected")
+                this.resume("the service accepted the session again");
+        })
+            .catch(() => undefined);
+    }
     async refreshOverNetwork() {
-        const res = await fetch(`${this.baseUrl}/auth/refresh`, {
-            method: "POST",
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify({ refreshToken: this.session.refreshToken }),
-        });
-        if (!res.ok)
-            throw new Error(`refresh failed: HTTP ${res.status}`);
-        const r = (await res.json());
+        const timeoutMs = serviceTimeoutMs();
+        const signal = timeoutSignal(timeoutMs);
+        const started = this.health.stamp();
+        let res;
+        try {
+            res = await fetch(`${this.baseUrl}/auth/refresh`, {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({ refreshToken: this.session.refreshToken }),
+                signal,
+            });
+        }
+        catch (err) {
+            const reason = signal.aborted ? `timed out after ${timeoutMs} ms` : reasonOf(err);
+            this.health.fail(reason);
+            throw new ServiceError(`refresh failed: ${reason}`);
+        }
+        const type = res.headers.get("content-type") ?? "";
+        const text = await res.text().catch(() => "");
+        if (!res.ok) {
+            const page = isWebPage(text, type);
+            if (isUnhealthyStatus(res.status))
+                this.health.fail(`HTTP ${res.status}`);
+            else if (page && res.status === 403)
+                this.health.fail("html");
+            else
+                this.health.ok(started);
+            if ((res.status === 400 || res.status === 401) && !page && isJsonObject(text)) {
+                throw new RefreshRejected(`refresh refused: HTTP ${res.status}${detail(text, type)}`, res.status);
+            }
+            throw new ServiceError(`refresh failed: HTTP ${res.status}${page ? " (a web page)" : ""}`, res.status);
+        }
+        let body;
+        try {
+            body = JSON.parse(text);
+        }
+        catch {
+            body = undefined;
+        }
+        if (!isAuthResponse(body)) {
+            // Never saved: the next process would load a session with no token, call
+            // the file corrupt, and the refresh token just rotated would be lost.
+            const page = /html/i.test(type) || /^\s*</.test(text);
+            if (page)
+                this.health.fail("html");
+            else
+                this.health.ok(started);
+            throw new ServiceError(`refresh failed: the answer was not a session${page ? " (a web page)" : ""} — nothing saved`);
+        }
+        this.health.ok(started);
         this.session = {
-            accessToken: r.accessToken,
-            refreshToken: r.refreshToken,
-            accessExpiresAt: Date.now() + r.expiresIn * 1000,
-            user: r.user,
+            accessToken: body.accessToken,
+            refreshToken: body.refreshToken,
+            accessExpiresAt: Date.now() + body.expiresIn * 1000,
+            user: body.user,
+            // Keep the binding. Dropping it here quietly turned off the check that
+            // stops a session being handed to another address, for every process,
+            // from the first refresh on.
+            authUrl: this.binding,
         };
         try {
             saveCredentials(this.session); // persist so the next run reuses it
+            this.noteFileSeen();
         }
         catch (err) {
             // Persisting is a convenience for the *next* process. Letting it throw
@@ -363,5 +1592,106 @@ export class RemoteRecorder {
             logLine("auth.save_failed", { error: errText(err), why: "the token still works in-process" });
         }
     }
+    /** The file now holds this recorder's session: follow it from here on. */
+    noteFileSeen() {
+        this.follow = true;
+        try {
+            this.credMtime = statSync(credentialsPath()).mtimeMs;
+            this.credCheckedAt = Date.now();
+        }
+        catch {
+            /* looked at again on the next check */
+        }
+    }
+    /**
+     * Keep in step with credentials.json, cheaply: one `stat` per
+     * {@link CREDENTIALS_CHECK_MS}, and a read only when it changed.
+     *
+     *   - gone          → `bir logout`: pause (`signed_out`), drop what is queued.
+     *   - another service → pause (`other_service`): never send there.
+     *   - another account → adopt it for runs opened from now on; runs already
+     *     open are closed, so no run is split across two accounts.
+     *   - newer tokens  → adopt them (a sibling refreshed, or `bir login`), and
+     *     resume if paused.
+     */
+    checkCredentials() {
+        this.retryRejected();
+        if (!this.follow)
+            return;
+        const now = Date.now();
+        if (now - this.credCheckedAt < this.credentialsCheckMs)
+            return;
+        this.credCheckedAt = now;
+        let mtime;
+        try {
+            mtime = statSync(credentialsPath()).mtimeMs;
+        }
+        catch (err) {
+            if (err.code === "ENOENT") {
+                this.credMtime = -1;
+                this.pause("signed_out");
+            }
+            return;
+        }
+        if (mtime === this.credMtime)
+            return;
+        const stored = loadCredentials();
+        if (!stored)
+            return; // unreadable for now: look again next time
+        this.credMtime = mtime;
+        if (!issuedFor(stored, this.binding)) {
+            this.pause("other_service");
+            return;
+        }
+        if (stored.user.id !== this.session.user.id) {
+            this.session = { ...stored, authUrl: stored.authUrl ?? this.binding };
+            this.refreshRetryAt = 0;
+            logLine("recorder.account_changed", {
+                user: stored.user.email,
+                why: "another account signed in on this machine — runs already open stop here, new ones record under it",
+            });
+            if (this.state !== "recording")
+                this.resume();
+            return;
+        }
+        const sameTokens = stored.accessToken === this.session.accessToken && stored.refreshToken === this.session.refreshToken;
+        if (!sameTokens) {
+            this.refreshRetryAt = 0;
+            if (stored.accessExpiresAt - 30_000 > now || this.state !== "recording") {
+                this.session = { ...stored, authUrl: stored.authUrl ?? this.binding };
+            }
+            else if (stored.refreshToken !== this.session.refreshToken) {
+                this.session = { ...this.session, refreshToken: stored.refreshToken };
+            }
+            if (this.state !== "recording")
+                this.resume();
+        }
+        else if (this.state === "signed_out" || this.state === "other_service") {
+            // The same session came back (a restore): nothing was refused.
+            this.resume();
+        }
+    }
+    pause(state) {
+        if (this.state === state)
+            return;
+        this.state = state;
+        let dropped = 0;
+        for (const lane of this.lanes.values()) {
+            const jobs = lane.jobs;
+            lane.jobs = [];
+            for (const job of jobs) {
+                this.pendingSends -= 1;
+                this.pendingBytes -= job.bytes;
+                this.retire(job, job.runId ? this.runs.get(job.runId) : undefined, state);
+                dropped += 1;
+            }
+        }
+        logLine("recorder.paused", { reason: state, dropped: dropped || undefined, why: PAUSE_WHY[state] });
+    }
+    resume(why = "a session is back in credentials.json") {
+        this.state = "recording";
+        this.lastAheadAttempt = 0;
+        logLine("recorder.resumed", { user: this.session.user.email, why });
+    }
 }
 //# sourceMappingURL=remote-recorder.js.map