@deepseek-harness-tui/dsh-tui 0.10.2 → 0.11.1

package/lib/types/dsh-adapter/channel/background-action.js

@@ -5,6 +5,8 @@ import { readModelPref } from '../../modelPrefs.js';
 import { readPresetPref } from '../../presetPrefs.js';
 import { clearResumeTarget, touchAgentViewSession, touchSession } from '../../sessionHistory.js';
 import { t } from '../../i18n.js';
+import { reserveMount } from '../../sessionMounts.js';
+import { mountFailureText } from '../../sessions/resumeFailure.js';
 import { composePreset } from '../presets.js';
 import { attachSessionToWorkspace } from '../workspace.js';
 import { resetSessionProjection } from './session-reset.js';
@@ -19,6 +21,13 @@ export function createBackgroundCurrentAction(ctx, state, options, deps) {
             return { ok: false, reason: 'unavailable' };
         }
         const sessionId = SessionId(randomUUID());
+        // Reserve before the factory: from the moment `agents.create` returns this
+        // process holds the only write handle on a log the publisher has not named
+        // yet, and a peer listing sessions in that gap would be told it is free.
+        const reserved = await reserveMount(sessionId);
+        if (!reserved.ok && reserved.reason !== 'occupied')
+            deps.notify(mountFailureText(reserved), { color: 'warning', timeoutMs: 8000 });
+        const reservation = reserved.ok ? reserved.reservation : { settle: () => { }, abandon: () => { } };
         try {
             const composed = await composePreset(ctx, options.configuredPreset ?? readPresetPref());
             const route = await validateModelRoute(ctx.get('llm'), resolveModelRoute({ provider: options.configuredProvider, model: options.configuredModel }, readModelPref(), { provider: options.provider, model: options.model }), { provider: options.provider, model: options.model });
@@ -30,6 +39,7 @@ export function createBackgroundCurrentAction(ctx, state, options, deps) {
             }));
             if (!deps.binding.isCurrent(adoption)) {
                 await deps.binding.abandon(handle);
+                reservation.abandon();
                 return { ok: false, reason: 'failed', error: 'Channel lifetime ended' };
             }
             try {
@@ -45,39 +55,53 @@ export function createBackgroundCurrentAction(ctx, state, options, deps) {
             // agent; the prepared candidate is abandoned instead.
             if (!deps.binding.isCurrent(adoption)) {
                 await deps.binding.abandon(handle);
+                reservation.abandon();
                 return { ok: false, reason: 'failed', error: 'Channel lifetime ended' };
             }
-            return deps.binding.adopt(handle, adoption, (previous, disposePrevious) => {
-                const previousSessionId = String(previous.agent.session.id);
-                if (previous.handle !== undefined) {
-                    deps.backgroundHandles.set(previousSessionId, previous.handle);
-                    disposePrevious('park');
-                }
-                resetSessionProjection(state, deps.rowIds, deps.resetProjector, deps.resetSubagents, deps.resetJobs);
-                state.status = handle.agent.status;
-                state.agentId = handle.agent.id;
-                state.loadedContext = undefined;
-                state.contextWindow = undefined;
-                state.effortLevels = undefined;
-                state.reasoningEffort = undefined;
-                deps.refreshEffortLevels();
-                // Reset the input FIFO and pending-decision indicators BEFORE the first
-                // emit (main's bind → clear → refresh order).
-                deps.clearStagedImages();
-                deps.bindAgent();
-                deps.refreshCommands();
-                void deps.refreshLoadedContext();
-                void deps.refreshSkillCommands();
-                clearResumeTarget();
-                touchSession(handle.agent.id);
-                touchAgentViewSession(previousSessionId);
-                touchAgentViewSession(String(handle.agent.id));
-                deps.notifySessionSwitched('background', String(handle.agent.id), previousSessionId);
-                deps.notifyAgentView();
-                return { ok: true, backgroundedSessionId: previousSessionId };
-            });
+            let committed = false;
+            try {
+                const result = deps.binding.adopt(handle, adoption, (previous, disposePrevious) => {
+                    const previousSessionId = String(previous.agent.session.id);
+                    if (previous.handle !== undefined) {
+                        deps.backgroundHandles.set(previousSessionId, previous.handle);
+                        disposePrevious('park');
+                    }
+                    resetSessionProjection(state, deps.rowIds, deps.resetProjector, deps.resetSubagents, deps.resetJobs);
+                    state.status = handle.agent.status;
+                    state.agentId = handle.agent.id;
+                    state.sessionId = handle.agent.session.id;
+                    state.loadedContext = undefined;
+                    state.contextWindow = undefined;
+                    state.effortLevels = undefined;
+                    state.reasoningEffort = undefined;
+                    deps.refreshEffortLevels();
+                    // Reset the input FIFO and pending-decision indicators BEFORE the first
+                    // emit (main's bind → clear → refresh order).
+                    deps.clearStagedImages();
+                    deps.bindAgent();
+                    deps.refreshCommands();
+                    void deps.refreshLoadedContext();
+                    void deps.refreshSkillCommands();
+                    clearResumeTarget();
+                    touchSession(handle.agent.id);
+                    touchAgentViewSession(previousSessionId);
+                    touchAgentViewSession(String(handle.agent.id));
+                    deps.notifySessionSwitched('background', String(handle.agent.id), previousSessionId);
+                    deps.notifyAgentView();
+                    return { ok: true, backgroundedSessionId: previousSessionId };
+                });
+                committed = true;
+                return result;
+            }
+            finally {
+                if (committed)
+                    reservation.settle();
+                else
+                    reservation.abandon();
+            }
         }
         catch (error) {
+            reservation.abandon();
             const message = error instanceof Error ? error.message : String(error);
             deps.notify(t('agentview-dispatch-failed', { err: message }), { color: 'error', timeoutMs: 8000 });
             return { ok: false, reason: 'failed', error: message };

package/lib/types/dsh-adapter/channel/binding-events.d.ts

@@ -16,12 +16,12 @@ export declare function createBindingEvents(ctx: Context, deps: {
     owner: ChannelOwner;
     binding: ChannelBinding;
     state: ChannelState;
-    activity: {
-        start(agent: ChannelBinding['agent']): void;
-        stop(): void;
-        onAgentStatus(status: ChannelBinding['agent']['status']): unknown;
-        onSessionEvent(event: unknown): unknown;
-    };
+    /** Read the activity projection's current value for a freshly bound session.
+     *  A projection value only arrives when it changes, so a resumed or
+     *  reattached session needs this read to show its line before the next event.
+     *  The line's semantics live in the working-activity plugin: this app folds
+     *  nothing itself and forwards no events. */
+    seedActivity?(session: unknown): void;
     inputConvergence: InputConvergence;
     selection: ModelSelectionRef;
     modelActions: {
@@ -36,6 +36,7 @@ export declare function createBindingEvents(ctx: Context, deps: {
     subagents: {
         onSessionEvent(session: unknown, event: unknown): boolean;
         onStreamFrame?(agent: unknown, frame: AssistantStreamFrame): boolean;
+        onParentEvent?(event: unknown): void;
         onStart(info: {
             id: string;
             runId?: string;
@@ -44,6 +45,7 @@ export declare function createBindingEvents(ctx: Context, deps: {
         }): void;
         onEnd(info: {
             id: string;
+            runId?: string;
             stopReason: string;
             lastAssistantMessage?: unknown[];
         }): void;

package/lib/types/dsh-adapter/channel/binding-events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"binding-events.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/channel/binding-events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AACrF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAE,KAAK,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;IACtD,KAAK,EAAE,YAAY,CAAA;IACnB,OAAO,EAAE,cAAc,CAAA;IACvB,KAAK,EAAE,YAAY,CAAA;IACnB,QAAQ,EAAE;QACR,KAAK,CAAC,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,IAAI,CAAA;QAC3C,IAAI,IAAI,IAAI,CAAA;QACZ,aAAa,CAAC,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAA;QACjE,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAA;KACxC,CAAA;IACD,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,SAAS,EAAE,iBAAiB,CAAA;IAC5B,YAAY,EAAE;QAAE,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,SAAS,EAAE,iBAAiB,CAAA;KAAE,CAAA;IACrF,WAAW,EAAE;QAAE,WAAW,IAAI,IAAI,CAAC;QAAC,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAA;IAC5F,SAAS,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAA;IACrD,SAAS,EAAE;QAAE,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;QAAC,aAAa,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC;QAAC,OAAO,CAAC,IAAI,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,IAAI,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAC;YAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,CAAA;IAC/T,SAAS,EAAE;QAAE,QAAQ,IAAI,IAAI,CAAA;KAAE,CAAA;IAC/B,eAAe,CAAC,EAAE;QAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAA;IACrE;;;sCAGkC;IAClC,gBAAgB,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3C;gBAYkB,IAAI;EAgItB"}
+{"version":3,"file":"binding-events.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/channel/binding-events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AACrF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAE,KAAK,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;IACtD,KAAK,EAAE,YAAY,CAAA;IACnB,OAAO,EAAE,cAAc,CAAA;IACvB,KAAK,EAAE,YAAY,CAAA;IACnB;;;;iDAI6C;IAC7C,YAAY,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACrC,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,SAAS,EAAE,iBAAiB,CAAA;IAC5B,YAAY,EAAE;QAAE,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,SAAS,EAAE,iBAAiB,CAAA;KAAE,CAAA;IACrF,WAAW,EAAE;QAAE,WAAW,IAAI,IAAI,CAAC;QAAC,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAA;IAC5F,SAAS,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAA;IACrD,SAAS,EAAE;QAAE,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;QAAC,aAAa,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC;QAAC,aAAa,CAAC,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;QAAC,OAAO,CAAC,IAAI,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,IAAI,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAC;YAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,CAAA;IACrX,SAAS,EAAE;QAAE,QAAQ,IAAI,IAAI,CAAA;KAAE,CAAA;IAC/B,eAAe,CAAC,EAAE;QAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAA;IACrE;;;sCAGkC;IAClC,gBAAgB,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3C;gBAYkB,IAAI;EAiItB"}

package/lib/types/dsh-adapter/channel/binding-events.js

@@ -22,7 +22,7 @@ export function createBindingEvents(ctx, deps) {
             deps.state.agentBindingGeneration = deps.binding.bind();
             deps.inputConvergence.cancelInFlight = false;
             deps.inputConvergence.interruptSeq += 1;
-            deps.activity.start(deps.binding.agent);
+            deps.seedActivity?.(deps.binding.agent.session);
             deps.modelActions.selection.current = undefined;
             deps.modelActions.selection.assembled = undefined;
             if (deps.binding.agent.options?.model === undefined && deps.state.provider !== '' && deps.state.model !== '') {
@@ -80,7 +80,6 @@ export function createBindingEvents(ctx, deps) {
                 if (!current() || subject !== capture.agent)
                     return;
                 deps.state.status = status;
-                deps.activity.onAgentStatus(status);
                 if (status === 'idle')
                     reconcileRetiredProjection('idle');
                 deps.state.emit();
@@ -89,7 +88,6 @@ export function createBindingEvents(ctx, deps) {
                 if (!current() || subject !== capture.agent)
                     return;
                 deps.state.status = 'disposed';
-                deps.activity.stop();
                 reconcileRetiredProjection('disposed');
                 deps.state.emit();
             });
@@ -125,7 +123,10 @@ export function createBindingEvents(ctx, deps) {
                 if (!isMainSession)
                     return;
                 deps.messageObserver?.publish(subject, event);
-                deps.activity.onSessionEvent(event);
+                // Parent-log discovery events (`subagent/catalog`, workflow member
+                // edges) reach the dashboard through the same firehose; they are not
+                // transcript rows and render below remains untouched by them.
+                deps.subagents.onParentEvent?.(event);
                 deps.modeActions.onSessionEvent(subject, event);
                 deps.projector.renderEvent(event);
                 if (event.type === 'assistant/chunk')

package/lib/types/dsh-adapter/channel/binding.d.ts

@@ -24,10 +24,27 @@ export declare function createChannelBinding(initial: Agent, handle: AgentHandle
     readonly generation: number;
     capture(): BindingCapture;
     isCurrent(capture: BindingCapture): boolean;
-    /** Create a candidate without giving it authority over the live binding. */
+    /**
+     * Create a candidate without giving it authority over the live binding.
+     *
+     * When the capture went stale the candidate is closed and the rejection
+     * WAITS for that close. The caller's `abandon(handle)` can no longer see the
+     * handle — it was never in `pending` — so waiting here is the only way the
+     * handle is known to have stopped writing before the caller gives its
+     * ledger reservation back.
+     */
     prepare(capture: BindingCapture, create: () => Promise<AgentHandle>): Promise<AgentHandle>;
-    /** Dispose an uncommitted candidate exactly once. Live handles are inert. */
+    /**
+     * Dispose an uncommitted candidate exactly once and WAIT for the close.
+     *
+     * Waiting is the point: callers use this on the path where they are about
+     * to give a cross-process ledger reservation back, and that reservation may
+     * only be released once the handle has actually stopped writing. A live
+     * handle that this cell never owned is inert here.
+     */
     abandon(candidate: AgentHandle): Promise<void>;
+    /** A registry may retain an agent while its async handle close drains. */
+    waitForDisposal(sessionId: string): Promise<void>;
     /** Perform one explicit synchronous prepared-handle adoption transaction. */
     adopt: <T>(candidate: AgentHandle, capture: BindingCapture, tail: (previous: BindingCommit, disposition: (next: PreviousDisposition) => void) => T) => T;
     /** Perform one explicit synchronous already-live-agent adoption transaction. */

package/lib/types/dsh-adapter/channel/binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"binding.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/channel/binding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAAA;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,KAAK,mBAAmB,GAAG,SAAS,GAAG,MAAM,CAAA;AAE7C;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,GAAG,SAAS,EAAE,KAAK,EAAE,YAAY;;;;eAiK1F,cAAc;uBACN,cAAc;IAEjC,4EAA4E;qBACrD,cAAc,UAAU,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;IAkBhG,6EAA6E;uBACpD,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAEpD,6EAA6E;YAvIhE,CAAC,aACH,WAAW,WACb,cAAc,QACjB,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,IAAI,KAAK,CAAC,KACrF,CAAC;IAqIF,gFAAgF;eA5EhE,CAAC,SACV,KAAK,cACA,WAAW,GAAG,SAAS,QAC7B,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,IAAI,KAAK,CAAC,KACrF,CAAC;;uBAsFiB,MAAM,IAAI;qCAvLS,MAAM,IAAI,KAAG,OAAO;EA0L7D;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAA"}
+{"version":3,"file":"binding.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/channel/binding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAAA;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,KAAK,mBAAmB,GAAG,SAAS,GAAG,MAAM,CAAA;AAE7C;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,GAAG,SAAS,EAAE,KAAK,EAAE,YAAY;;;;eAsM1F,cAAc;uBACN,cAAc;IAEjC;;;;;;;;OAQG;qBACoB,cAAc,UAAU,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;IAkBhG;;;;;;;OAOG;uBACsB,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD,0EAA0E;+BACzC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvD,6EAA6E;YA7JhE,CAAC,aACH,WAAW,WACb,cAAc,QACjB,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,IAAI,KAAK,CAAC,KACrF,CAAC;IA2JF,gFAAgF;eAlGhE,CAAC,SACV,KAAK,cACA,WAAW,GAAG,SAAS,QAC7B,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,IAAI,KAAK,CAAC,KACrF,CAAC;;uBA4GiB,MAAM,IAAI;qCAvNS,MAAM,IAAI,KAAG,OAAO;EA0N7D;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAA"}

package/lib/types/dsh-adapter/channel/binding.js

@@ -14,17 +14,46 @@ export function createChannelBinding(initial, handle, owner) {
     let subscriptions = [];
     let handoff;
     const pending = new Map();
-    const disposed = new WeakSet();
+    /**
+     * The in-flight (or finished) close of a handle this cell owns, keyed by the
+     * handle. A Promise rather than a "has it started" flag, because the callers
+     * that matter need to know when the handle has actually STOPPED writing: a
+     * ledger reservation is only safe to give back after that, and a second
+     * `dispose()` must not start a parallel close.
+     */
+    const closing = new WeakMap();
+    const closingSessions = new Map();
+    /** Close `candidate` exactly once; the result resolves however it ends. */
     const dispose = (candidate) => {
-        if (disposed.has(candidate))
-            return;
-        disposed.add(candidate);
-        void candidate.dispose().catch(() => undefined);
+        const started = closing.get(candidate);
+        if (started !== undefined)
+            return started;
+        // Kicked off SYNCHRONOUSLY: revocation is part of a synchronous transaction
+        // boundary, and a caller that abandons a candidate may check it right away.
+        // Only the waiting is deferred, never the call.
+        let close;
+        try {
+            close = Promise.resolve(candidate.dispose()).catch(() => undefined);
+        }
+        catch {
+            close = Promise.resolve();
+        }
+        closing.set(candidate, close);
+        const id = String(candidate.agent.session.id);
+        closingSessions.set(id, close);
+        void close.then(() => {
+            if (closingSessions.get(id) === close)
+                closingSessions.delete(id);
+        });
+        return close;
     };
     const disposePending = (candidate) => {
-        if (!pending.delete(candidate))
-            return;
-        dispose(candidate);
+        if (pending.delete(candidate))
+            return dispose(candidate);
+        // Already un-pended (a revocation path took it out from under the caller):
+        // hand back the close that is already running, so a caller that HAS to
+        // wait — one about to give a ledger reservation back — still can.
+        return closing.get(candidate);
     };
     const clearSubscriptions = (afterEach) => {
         const active = subscriptions.splice(0);
@@ -49,23 +78,33 @@ export function createChannelBinding(initial, handle, owner) {
         return failure;
     };
     const isCaptureCurrent = (capture) => owner.current() && capture.agent === currentAgent && capture.generation === generation;
+    /**
+     * Start a close without waiting for it. The callers below are synchronous
+     * transaction boundaries — they must not turn into awaits — but the close
+     * itself stays observable through {@link dispose}, so a caller that DOES have
+     * to wait (an `abandon` handing a ledger reservation back) still can.
+     */
+    const startClose = (close) => {
+        void close;
+    };
     const assertPrepared = (candidate, capture) => {
         if (pending.get(candidate) !== capture || !isCaptureCurrent(capture)) {
-            disposePending(candidate);
+            startClose(disposePending(candidate));
             throw new Error('dsh-tui: Channel binding changed before adoption');
         }
     };
     const settlePrevious = (previous, disposition) => {
         // Parking deliberately transfers ownership to the caller's background
         // ledger. Disposal is centralised here so no adoption tail can double-call
-        // an old handle while its transaction is being revoked.
+        // an old handle while its transaction is being revoked. Neither path waits:
+        // an ordinary session switch must not block on the handle it just left.
         if (disposition === 'dispose' && previous.handle !== undefined && previous.handle !== currentHandle) {
-            dispose(previous.handle);
+            startClose(dispose(previous.handle));
         }
     };
     owner.own(clearSubscriptions);
     owner.own(() => { for (const candidate of [...pending.keys()])
-        disposePending(candidate); });
+        startClose(disposePending(candidate)); });
     const adopt = (candidate, capture, tail) => {
         if (handoff !== undefined) {
             // Mark the outer transaction superseded as well as rejecting this one;
@@ -120,7 +159,7 @@ export function createChannelBinding(initial, handle, owner) {
             if (currentHandle === candidate) {
                 currentHandle = undefined;
             }
-            dispose(candidate);
+            startClose(dispose(candidate));
             owner.dispose();
             throw error;
         }
@@ -185,27 +224,48 @@ export function createChannelBinding(initial, handle, owner) {
         get generation() { return generation; },
         capture() { return { agent: currentAgent, generation }; },
         isCurrent(capture) { return isCaptureCurrent(capture); },
-        /** Create a candidate without giving it authority over the live binding. */
+        /**
+         * Create a candidate without giving it authority over the live binding.
+         *
+         * When the capture went stale the candidate is closed and the rejection
+         * WAITS for that close. The caller's `abandon(handle)` can no longer see the
+         * handle — it was never in `pending` — so waiting here is the only way the
+         * handle is known to have stopped writing before the caller gives its
+         * ledger reservation back.
+         */
         async prepare(capture, create) {
             owner.assertActive();
             if (!isCaptureCurrent(capture))
                 throw new Error('dsh-tui: Channel binding changed before preparation');
             const candidate = await create();
             if (!isCaptureCurrent(capture)) {
-                dispose(candidate);
+                await dispose(candidate);
                 throw new Error('dsh-tui: Channel binding changed during preparation');
             }
             pending.set(candidate, capture);
             // Owner disposal may synchronously occur through embedding hooks while
             // ownership is registered; verify the pending entry itself as well.
             if (!isCaptureCurrent(capture) || pending.get(candidate) !== capture) {
-                disposePending(candidate);
+                await disposePending(candidate);
                 throw new Error('dsh-tui: Channel binding changed during preparation');
             }
             return candidate;
         },
-        /** Dispose an uncommitted candidate exactly once. Live handles are inert. */
-        async abandon(candidate) { disposePending(candidate); },
+        /**
+         * Dispose an uncommitted candidate exactly once and WAIT for the close.
+         *
+         * Waiting is the point: callers use this on the path where they are about
+         * to give a cross-process ledger reservation back, and that reservation may
+         * only be released once the handle has actually stopped writing. A live
+         * handle that this cell never owned is inert here.
+         */
+        async abandon(candidate) {
+            await disposePending(candidate);
+        },
+        /** A registry may retain an agent while its async handle close drains. */
+        async waitForDisposal(sessionId) {
+            await closingSessions.get(sessionId);
+        },
         /** Perform one explicit synchronous prepared-handle adoption transaction. */
         adopt,
         /** Perform one explicit synchronous already-live-agent adoption transaction. */

package/lib/types/dsh-adapter/channel/compaction.d.ts

@@ -10,7 +10,6 @@ export declare function createManualCompaction(ctx: Context, state: CompactionSt
     agent(): Agent;
     withDecisionPending<T>(name: string, pending: Promise<T>): Promise<T>;
     notify: Notify;
-    onComplete(): void;
 }): {
     compact: () => void;
     settle: () => Promise<void>;

package/lib/types/dsh-adapter/channel/compaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compaction.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/channel/compaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AACnD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAIlD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAO9C,KAAK,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,SAAS,GAAG,KAAK,GAAG,SAAS,CAAC,CAAA;AACxE,KAAK,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;AAEpC,mFAAmF;AACnF,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE;IACJ,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,GAAG,QAAQ,GAAG,KAAK,CAAC,CAAA;IACvD,KAAK,IAAI,KAAK,CAAA;IACd,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACrE,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,IAAI,IAAI,CAAA;CACnB;mBAuBmB,IAAI;kBAlBC,OAAO,CAAC,IAAI,CAAC;EAwGvC"}
+{"version":3,"file":"compaction.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/channel/compaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AACnD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAIlD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAO9C,KAAK,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,SAAS,GAAG,KAAK,GAAG,SAAS,CAAC,CAAA;AACxE,KAAK,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;AAEpC,mFAAmF;AACnF,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE;IACJ,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,GAAG,QAAQ,GAAG,KAAK,CAAC,CAAA;IACvD,KAAK,IAAI,KAAK,CAAA;IACd,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACrE,MAAM,EAAE,MAAM,CAAA;CACf;mBAuBmB,IAAI;kBAlBC,OAAO,CAAC,IAAI,CAAC;EAuGvC"}

package/lib/types/dsh-adapter/channel/compaction.js

@@ -78,8 +78,6 @@ export function createManualCompaction(ctx, state, deps) {
                     if (!isCurrent())
                         return;
                     deps.notify(result ? t('compact-done') : t('compact-nothing'));
-                    if (result)
-                        deps.onComplete();
                 }
                 catch (error) {
                     if (!isCurrent() || cancelled.has(controller))

package/lib/types/dsh-adapter/channel/composer-images.d.ts

@@ -19,6 +19,11 @@ export declare function firstStaleComposerToken(text: string, ordered: ReadonlyM
 export interface ComposerImageLimits {
     readonly maxImageBytes: number;
     readonly maxImagesPerMessage: number;
+    /** Per-side intrinsic pixel cap mirrored from the upstream store so the
+     *  ingress gate can resample before staging (issue #938). */
+    readonly maxImageDimension: number;
+    /** Total-pixel cap ditto. */
+    readonly maxImagePixels: number;
 }
 /** The composer's staged-image capability store plus its draft-binding rules. */
 export interface ComposerImages {

package/lib/types/dsh-adapter/channel/composer-images.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"composer-images.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/channel/composer-images.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAIlD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EAChB,MAAM,YAAY,CAAA;AAEnB,iEAAiE;AACjE,eAAO,MAAM,oBAAoB,QAAqB,CAAA;AAEtD;6EAC6E;AAC7E,eAAO,MAAM,0BAA0B,QAAsB,CAAA;AAE7D,eAAO,MAAM,sBAAsB,GAAI,WAAW,MAAM,KAAG,MACe,CAAA;AAE1E;;;2EAG2E;AAC3E,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,SAAS,gBAAgB,EAAE,EACjC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,GAC7B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAehB;AAED;;4EAE4E;AAC5E,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GACpC,MAAM,GAAG,SAAS,CAKpB;AAOD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;CACrC;AAED,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B;sEACkE;IAClE,qBAAqB,IAAI,MAAM,CAAA;IAC/B;yEACqE;IACrE,UAAU,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACpD;iFAC6E;IAC7E,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC3F,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAA;IACxC,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACzC,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAA;IACzD,iBAAiB,IAAI,mBAAmB,GAAG,SAAS,CAAA;IACpD;0EACsE;IACtE,iBAAiB,IAAI,IAAI,CAAA;IACzB,6EAA6E;IAC7E,QAAQ,IAAI,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAA;IAChE;4DACwD;IACxD,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,gBAAgB,EAAE,GAAG,SAAS,gBAAgB,EAAE,CAAA;IACtG,wEAAwE;IACxE,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,gBAAgB,EAAE,GAAG,SAAS,gBAAgB,EAAE,CAAA;CACnG;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE;IAAE,UAAU,IAAI,MAAM,CAAA;CAAE,GAC7B,cAAc,CAsKhB"}
+{"version":3,"file":"composer-images.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/channel/composer-images.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAMlD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAEhB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EAChB,MAAM,YAAY,CAAA;AAEnB,iEAAiE;AACjE,eAAO,MAAM,oBAAoB,QAAqB,CAAA;AAEtD;6EAC6E;AAC7E,eAAO,MAAM,0BAA0B,QAAsB,CAAA;AAE7D,eAAO,MAAM,sBAAsB,GAAI,WAAW,MAAM,KAAG,MACe,CAAA;AAE1E;;;2EAG2E;AAC3E,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,SAAS,gBAAgB,EAAE,EACjC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,GAC7B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAehB;AAED;;4EAE4E;AAC5E,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GACpC,MAAM,GAAG,SAAS,CAKpB;AAOD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC;iEAC6D;IAC7D,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,6BAA6B;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B;sEACkE;IAClE,qBAAqB,IAAI,MAAM,CAAA;IAC/B;yEACqE;IACrE,UAAU,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACpD;iFAC6E;IAC7E,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC3F,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAA;IACxC,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACzC,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAA;IACzD,iBAAiB,IAAI,mBAAmB,GAAG,SAAS,CAAA;IACpD;0EACsE;IACtE,iBAAiB,IAAI,IAAI,CAAA;IACzB,6EAA6E;IAC7E,QAAQ,IAAI,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAA;IAChE;4DACwD;IACxD,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,gBAAgB,EAAE,GAAG,SAAS,gBAAgB,EAAE,CAAA;IACtG,wEAAwE;IACxE,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,gBAAgB,EAAE,GAAG,SAAS,gBAAgB,EAAE,CAAA;CACnG;AA0BD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE;IAAE,UAAU,IAAI,MAAM,CAAA;CAAE,GAC7B,cAAc,CAyPhB"}

package/lib/types/dsh-adapter/channel/composer-images.js

@@ -1,5 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { rememberImagePath, transcriptImageFromAttachment } from '../transcript-images.js';
+import { probeImageSize, adaptImageForAdmission, withinDimensionLimits } from '../../utils/imageResize.js';
 import { mentionAttachments } from './mentions.js';
 /** Every visible composer placeholder token, in source order. */
 export const COMPOSER_IMAGE_TOKEN = /\[Image #\d+\]/gu;
@@ -45,6 +46,24 @@ export function firstStaleComposerToken(text, ordered) {
  *  content-addressed and durable; this map only connects editable
  *  placeholders to them. */
 const STAGED_IMAGE_LIMIT = 128;
+/** Failure text for a refusal the ingress gate can state before the store:
+ *  every reason except a missing sharp describes an image the deployment
+ *  would reject anyway, so the paste is refused with the cause named. */
+function admissionFailure(outcome, context) {
+    switch (outcome.reason) {
+        case 'sharp-missing':
+            return context.probe !== null
+                ? `image is ${context.probe.width}×${context.probe.height} (over ${context.limits.maxImageDimension}px) and sharp is unavailable to resample it`
+                : `${context.mediaType} is not accepted by this profile and sharp is unavailable to convert it`;
+        case 'animated-unsupported':
+            return `resizing or converting this animated image cannot keep its frames (${outcome.detail})`;
+        default:
+            return `image could not be decoded to resize or convert it (${outcome.detail})`;
+    }
+}
+/** A store-reported pixel dimension, or the gate's own value when the store
+ *  reported none (lean attachment fakes in the verify scripts). */
+const positiveOr = (value, fallback) => typeof value === 'number' && value > 0 ? value : fallback;
 /**
  * Owns the editable-composer image capabilities: the session epoch, the
  * capability map, its preview facades and the `[Image #N]` compatibility
@@ -121,16 +140,78 @@ export function createComposerImages(ctx, owner, deps) {
         if (generation !== stagedImageEpoch) {
             throw new Error('the session changed while the image was being staged');
         }
-        if (!attachments.imageLimits.mediaTypes.includes(input.mediaType)) {
-            throw new Error(`${input.mediaType} images are not accepted by this profile`);
-        }
         if (input.data.byteLength > attachments.imageLimits.maxImageBytes) {
             throw new Error(`image exceeds this profile's per-image size limit`);
         }
+        // Ingress adaptation (issue #938): the store admits by media type, byte
+        // budget and the per-side / total pixel caps, and refuses on all of them
+        // when the bytes reach it. Measure and re-encode HERE instead, while the
+        // paste can still be explained to the user. Admission is judged against
+        // the pair this gate HANDS OVER (the store may normalize further on its
+        // own — that step is outside this feature), and both triggers are
+        // size-independent:
+        //   * a source media type the profile does not accept is converted, so a
+        //     small PNG is never refused while a large one succeeds;
+        //   * a probe-recognized image inside the caps skips sharp entirely;
+        //   * an unrecognized format is decoded for measurement (never trusted by
+        //     byte budget alone — the #432 gap);
+        //   * with sharp absent the image goes to the store unchanged ONLY while
+        //     it is still admissible as-is — an accepted format whose size the
+        //     probe could not prove fits (upstream stays the backstop); a measured
+        //     oversize, a decode failure, an unaccepted format or a multi-frame
+        //     image this gate would have to re-encode is reported now instead of
+        //     becoming a token that dies at save time.
+        // The runtime guards keep older attachment fakes (whose imageLimits
+        // predate the dimension fields) on the legacy synchronous path.
+        const dimensionCap = attachments.imageLimits.maxImageDimension;
+        const pixelCap = attachments.imageLimits.maxImagePixels;
+        let mediaType = input.mediaType;
+        let data = input.data;
+        let adapted;
+        if (typeof dimensionCap === 'number' && typeof pixelCap === 'number'
+            && Number.isFinite(dimensionCap) && Number.isFinite(pixelCap)) {
+            const dimensionLimits = { maxImageDimension: dimensionCap, maxImagePixels: pixelCap };
+            const probe = probeImageSize(data);
+            const sourceAccepted = attachments.imageLimits.mediaTypes.includes(mediaType);
+            // Only a probe-measured oversize is *known* to be refused by the store;
+            // an unmeasurable image may well be admissible, which is what keeps the
+            // sharp-less degradation a degradation rather than a guess.
+            const knownOversize = probe !== null && !withinDimensionLimits(probe, dimensionLimits);
+            if (!sourceAccepted || probe === null || knownOversize) {
+                const outcome = await adaptImageForAdmission(data, mediaType, dimensionLimits, attachments.imageLimits.mediaTypes);
+                if (outcome.kind === 'adapted') {
+                    // outcome.mediaType comes from the accepted list inside the gate, so
+                    // it is one of the profile's media types at runtime — narrowing,
+                    // not trusting.
+                    mediaType = outcome.mediaType;
+                    data = outcome.data;
+                    adapted = outcome;
+                    if (data.byteLength > attachments.imageLimits.maxImageBytes) {
+                        throw new Error(`image still exceeds this profile's per-image size limit after resampling`);
+                    }
+                }
+                else if (outcome.kind === 'unavailable') {
+                    // Degrade ONLY when the paste is still admissible as-is: an accepted
+                    // format whose size the probe could not prove fits. Everything else
+                    // (measured oversize, unaccepted format, decode failure, animation
+                    // that cannot survive) is a refusal we can state now.
+                    const degraded = outcome.reason === 'sharp-missing' && sourceAccepted && !knownOversize;
+                    if (!degraded)
+                        throw new Error(admissionFailure(outcome, { probe, mediaType, limits: dimensionLimits }));
+                }
+            }
+        }
+        // What the store will actually see: an accepted media type, inside the
+        // byte cap. A media type can still be unaccepted here only when the
+        // adaptation did not run (legacy limits) or could not produce one.
+        if (!attachments.imageLimits.mediaTypes.includes(mediaType)) {
+            throw new Error(`${mediaType} images are not accepted by this profile`);
+        }
         // The source path is TUI-side display metadata; the store only sees the
-        // fields its contract names.
+        // fields its contract names. mediaType/data may be the adapted pair from
+        // the ingress gate above.
         const { path, ...stored } = input;
-        const attachment = await attachments.saveImage(stored);
+        const attachment = await attachments.saveImage({ ...stored, mediaType, data });
         // A session change (/new, resume, rewind, model switch, background)
         // cleared the maps while the save was in flight: the durable object is
         // harmless, but the OLD session's capability must not reach the new one.
@@ -151,7 +232,23 @@ export function createComposerImages(ctx, owner, deps) {
                 break;
             deleteStagedImage(oldest);
         }
-        return { stageId };
+        // The adjustment travels with the capability so the composer can say what
+        // happened instead of letting a rewritten image reach the store silently.
+        // Its numbers come from the STORE's own report, not from what this gate
+        // handed over: the store normalizes further (dimensions, and the media type
+        // too), and a notice quoting the gate's numbers would contradict the
+        // preview card the user is looking at.
+        const adjustment = adapted === undefined ? undefined : {
+            sourceMediaType: input.mediaType,
+            mediaType: attachment.mediaType,
+            width: positiveOr(attachment.width, adapted.width),
+            height: positiveOr(attachment.height, adapted.height),
+            resized: adapted.resized
+                || positiveOr(attachment.width, adapted.width) !== adapted.width
+                || positiveOr(attachment.height, adapted.height) !== adapted.height,
+            flattened: adapted.flattened,
+        };
+        return adjustment === undefined ? { stageId } : { stageId, adjustment };
     };
     return {
         stagedImageGeneration() {
@@ -195,6 +292,8 @@ export function createComposerImages(ctx, owner, deps) {
             return {
                 maxImageBytes: limits.maxImageBytes,
                 maxImagesPerMessage: limits.maxImagesPerMessage,
+                maxImageDimension: limits.maxImageDimension,
+                maxImagePixels: limits.maxImagePixels,
             };
         },
         clearStagedImages() {

package/lib/types/dsh-adapter/channel/context-bookkeeping.d.ts

@@ -5,6 +5,14 @@ export declare function createContextBookkeeping(state: () => {
     tokens: {
         input: number;
     };
+    /** Last turn's billed token shape; the honest numerator for the
+     * context-low warning (input alone misses cached reads/writes, which
+     * resumed sessions replay back at full size). */
+    lastUsage: {
+        input: number;
+        cacheRead: number;
+        cacheWrite: number;
+    } | undefined;
     pending: PendingMessage[];
     emit(): void;
 }, notify: (text: string, options: {

package/lib/types/dsh-adapter/channel/context-bookkeeping.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context-bookkeeping.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/channel/context-bookkeeping.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAElE,+EAA+E;AAC/E,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM;IACX,aAAa,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IACzB,OAAO,EAAE,cAAc,EAAE,CAAA;IACzB,IAAI,IAAI,IAAI,CAAA;CACb,EACD,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,EACnF,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,EAC3C,mBAAmB,EAAE,MAAM;;;;+BAwBK,IAAI;+BArBJ,IAAI;4BAUL;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAA;KAAE,aAAa,cAAc,CAAC,WAAW,CAAC,KAAG,IAAI;gCAK7G,MAAM,KAAG,IAAI;EAQjD"}
+{"version":3,"file":"context-bookkeeping.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/channel/context-bookkeeping.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAElE,+EAA+E;AAC/E,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM;IACX,aAAa,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IACzB;;qDAEiD;IACjD,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAA;IAC/E,OAAO,EAAE,cAAc,EAAE,CAAA;IACzB,IAAI,IAAI,IAAI,CAAA;CACb,EACD,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,EACnF,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,EAC3C,mBAAmB,EAAE,MAAM;;;;+BAyBK,IAAI;+BAtBJ,IAAI;4BAWL;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAA;KAAE,aAAa,cAAc,CAAC,WAAW,CAAC,KAAG,IAAI;gCAK7G,MAAM,KAAG,IAAI;EAQjD"}

package/lib/types/dsh-adapter/channel/context-bookkeeping.js

@@ -3,9 +3,10 @@ export function createContextBookkeeping(state, notify, lowContextText, warningB
     const warning = { value: false };
     const checkContextWarning = () => {
         const channel = state();
-        if (warning.value || channel.contextWindow === undefined)
+        if (warning.value || channel.contextWindow === undefined || channel.lastUsage === undefined)
             return;
-        const remaining = channel.contextWindow - channel.tokens.input;
+        const used = channel.lastUsage.input + channel.lastUsage.cacheRead + channel.lastUsage.cacheWrite;
+        const remaining = channel.contextWindow - used;
         if (remaining >= warningBufferTokens)
             return;
         warning.value = true;