@jeffober/thatch 0.2.5 → 0.2.7

package/src/runtime.ts

@@ -1,6 +1,8 @@
+import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { createDebugLog } from "./debug";
+import { createDebugLog, type DebugLog } from "./debug";
 import { ThatchDB, repoPathCache } from "./db";
+import { chatOpenTabs as chatOpenTabsProvider } from "./tab-state";
 import { SharedModelPool } from "./embeddings";
 import { detectRepo, detectWorktreeKind, resolveSpawnCwd } from "./git";
 import { buildCoreContext } from "./tool-defs";
@@ -134,6 +136,47 @@ export interface ThatchRuntime {
   dispose(): Promise<void>;
 }
 
+/**
+ * Whether a wake delivery's target directory can host the attempt right
+ * now. existsSync cannot say WHY a path is absent - deleted worktree,
+ * broken symlink, permission on a parent - and none of those states can
+ * host a wake attempt, so one false answer covers the class (deliberate:
+ * the alternative, surfacing non-ENOENT errors through the attempt, buys
+ * a toast back for no recovery the mail does not already get from its
+ * pending-and-retry cycle). Synchronous on purpose: fire-and-forget
+ * callers and test harnesses observe promptSession timing with no added
+ * microtask between the gate and the wrapped call.
+ */
+export function directoryAvailable(path: string): boolean {
+  return existsSync(path);
+}
+
+/**
+ * The delivery guard: wraps the host's promptSession so a wake attempt
+ * never runs against a session whose directory has been deleted. The
+ * attempt itself would error, and opencode surfaces that failure to the
+ * user as a toast. Skipping instead leaves the pending mail queued - the
+ * check runs fresh on every attempt, so a worktree recreated at the same
+ * path (or a session revived in a live directory) resumes delivery with
+ * nothing lost. This covers every wake site at once because chat nudges,
+ * watcher notifications, watcher death notices, rehydrate pings, chat
+ * echoes, and extraction-child dispatch all funnel through promptSession,
+ * and a host instance is bound to its sessions' own directory.
+ */
+export function guardDelivery(
+  promptSession: HostCapabilities["promptSession"],
+  directory: string,
+  debug: DebugLog,
+): HostCapabilities["promptSession"] {
+  return (sessionID, body, mode) => {
+    if (!directoryAvailable(directory)) {
+      debug("runtime:delivery", `skipped wake to ${sessionID}: directory ${directory} no longer exists`);
+      return Promise.resolve();
+    }
+    return promptSession(sessionID, body, mode);
+  };
+}
+
 export async function createRuntime(input: {
   capabilities: HostCapabilities;
   directory: string;
@@ -146,7 +189,7 @@ export async function createRuntime(input: {
    */
   v2Tools?: boolean;
 }): Promise<ThatchRuntime> {
-  const { capabilities: caps, directory, worktree, v2Tools } = input;
+  const { capabilities, directory, worktree, v2Tools } = input;
   // The opencode server's cwd is wherever the server happened to start;
   // `worktree` is the project this plugin instance actually serves.
   // `directory` is the session's own directory - on resume after the
@@ -169,7 +212,10 @@ export async function createRuntime(input: {
 
   // The DB must exist before identity detection: detectRepo consults the
   // repo_paths cache when the session directory is gone.
-  const db = new ThatchDB(dbPath);
+  // chatOpenTabs composes the tab-state reader (tabs.json across channels,
+  // minus confirmed closes) lazily per call - never cached - so roster
+  // rendering and broadcast targeting see the current tab state.
+  const db: ThatchDB = new ThatchDB(dbPath, { chatOpenTabs: chatOpenTabsProvider(() => db.chatTabClosures()) });
   const repoCache = repoPathCache(db);
   const repo = await detectRepo(directory ?? worktree, repoCache);
 
@@ -181,6 +227,16 @@ export async function createRuntime(input: {
 
   const debug = createDebugLog(dbPath);
 
+  // The delivery guard wraps the host's promptSession once, so no wake
+  // attempt in this instance runs against a deleted directory (see
+  // guardDelivery). The v2 wrap-up command in opencode/v2.ts calls
+  // capabilities.promptSession directly and deliberately bypasses this
+  // wrapper: it is user-invoked in a live tab, not a wake.
+  const caps: HostCapabilities = {
+    ...capabilities,
+    promptSession: guardDelivery(capabilities.promptSession, directory ?? worktree, debug),
+  };
+
   // Shared embedding model: refcounted per db path (see SharedModelPool).
   const model = sharedModels.acquire(dbPath, modelName);
   const releaseModel = () => sharedModels.release(dbPath);
@@ -297,15 +353,24 @@ export async function createRuntime(input: {
   /** Tells one live same-project session about a dead session's watchers
    *  (promptAsync, the watcher-notification path) and clears the durable
    *  death row on success. No live peer = the row waits for the next
-   *  prompt-time surfacing pass. */
-  const deliverWatcherDeathNotices = async (deadSessionID: string, death: { chatName: string | null; targets: string[] }) => {
+   *  prompt-time surfacing pass. The dead session's project is the one
+   *  captured at death time (onSessionDeath), not a re-read of the chat
+   *  roster: the wrap-up exit unregisters the row between the death record
+   *  and this delivery, and a re-read would strand a placed death as
+   *  unplaceable. */
+  const deliverWatcherDeathNotices = async (
+    deadSessionID: string,
+    death: { chatName: string | null; targets: string[] },
+    deadProject: string | null,
+  ) => {
     if (death.targets.length === 0) {
-      // A watchless tab closing is nobody's news.
-      db.runtimeStateDelete("watcher_death", deadSessionID);
+      // A watchless death is nobody's news, and onSessionDeath never
+      // writes a row for one - so there is nothing to deliver or clean
+      // here. Deleting unconditionally would erase an earlier placed row
+      // for the same session (a reopened session's second greenlit
+      // /thatch/exit); the surfacing pass cleans any legacy empty row.
       return;
     }
-    const deadRow = db.findChatSession(deadSessionID);
-    const deadProject = deadRow?.project ?? null;
     if (!deadProject) return; // unplaceable death - the row waits for surfacing
     for (const peerID of sessionStatus.keys()) {
       if (peerID === deadSessionID) continue;
@@ -318,6 +383,10 @@ export async function createRuntime(input: {
           { parts: [{ type: "text", text: watcherDeathNotice(death.targets, { name: death.chatName, sessionID: deadSessionID }, { rearmsOnResume: false }), synthetic: true }] },
           "async",
         );
+        // Delayed journal writer (post-await): the reload ownership rule
+        // applies - a disposed runtime's rows belong to the reloaded
+        // instance (docs/dev/gotchas.md).
+        if (disposed) return;
         db.runtimeStateDelete("watcher_death", deadSessionID);
         return;
       } catch (err) {
@@ -399,11 +468,19 @@ export async function createRuntime(input: {
         db.runtimeStatePut("hosted", directory, (hostedRow.value as string[]).filter((sid) => sid !== deadSessionID), directory);
       }
       // Durable death record first, then best-effort live delivery - the
-      // row is deleted when a live same-project session has the news.
+      // row is deleted when a live same-project session has the news. The
+      // project is captured HERE (while the chat row still places it): the
+      // wrap-up exit unregisters the row right after recording, so the
+      // project cannot be re-derived at delivery time. A watchless death
+      // writes no row at all: runtimeStatePut upserts, so an empty-targets
+      // write would erase an earlier placed row for the same session (a
+      // reopened session that greenlights /thatch/exit a second time).
       const deadRow = db.findChatSession(deadSessionID);
       const deadProject = deadRow?.project ?? null;
-      db.runtimeStatePut("watcher_death", deadSessionID, { name: death.chatName, targets: death.targets, project: deadProject, at: nowIso() }, directory);
-      void deliverWatcherDeathNotices(deadSessionID, death);
+      if (death.targets.length > 0) {
+        db.runtimeStatePut("watcher_death", deadSessionID, { name: death.chatName, targets: death.targets, project: deadProject, at: nowIso() }, directory);
+      }
+      void deliverWatcherDeathNotices(deadSessionID, death, deadProject);
     },
   });
   // gh presence decides whether watch_create and watch_branch_create work;
@@ -1282,6 +1359,7 @@ export async function createRuntime(input: {
 
   return {
     coreContext: buildCoreContext(db, model, repo, {
+      openTabs: chatOpenTabsProvider(() => db.chatTabClosures()),
       extractionPayloadProvider: (targetID: string, fetcherID?: string): string | null => {
         // A fetcher identity turns the fetch into the delivery record: the
         // claimed entries stay accepted, and THAT fetcher's completion
@@ -1854,7 +1932,16 @@ export async function createRuntime(input: {
         // initiated only). CONFIRMED death: skip the delivery-persistence
         // heuristic entirely and run the death path now.
         const props = event.properties as { sessionID?: string; chatName?: string | null };
-        if (props.sessionID) watchers.sessionDied(props.sessionID, { chatName: props.chatName ?? null });
+        if (props.sessionID) {
+          // Roster demotion record: a confirmed close lets every reader
+          // (roster render, broadcast targeting) distrust a residue tab
+          // row for this session instantly, instead of waiting for
+          // tabs.json to agree or the heartbeat to age out. Self-expiring
+          // (CHAT_TAB_CLOSED_OVERRIDE_MS) and superseded by any later
+          // heartbeat, so a session that regains a tab reads OPEN again.
+          db.runtimeStatePut("chat_tab_closed", props.sessionID, { at: nowIso() }, directory);
+          watchers.sessionDied(props.sessionID, { chatName: props.chatName ?? null });
+        }
         return;
       }
       if (event.type === "session.status") {
@@ -1898,6 +1985,13 @@ export async function createRuntime(input: {
         const wrapUp = sessionID ? pendingWrapUp.get(sessionID) : undefined;
         if (wrapUp) {
           pendingWrapUp.delete(sessionID);
+          // Reload ownership rule (docs/dev/gotchas.md): after a v2 plugin
+          // reload this instance's journal rows belong to the reloaded
+          // instance - resolve nothing further once disposed. Safe today
+          // because the only producer of this branch (the v2 pump) is
+          // settled before dispose, but the guard makes that invariant
+          // local instead of transitive.
+          if (disposed) return;
           db.runtimeStateDelete("wrapup", sessionID);
           let ready = false;
           try {
@@ -1913,13 +2007,24 @@ export async function createRuntime(input: {
             console.error(`[thatch] wrap-up message fetch failed: ${err}`);
           }
           if (ready) {
-            // An exit-greenlit session is leaving the process: leave the
-            // chat directory too, so other sessions stop addressing mail to
-            // a roster entry whose host is about to vanish. The unregister
+            // An exit-greenlit session is closing out: leave the chat
+            // directory too, so other sessions stop addressing mail to a
+            // roster entry whose host is about to vanish. The unregister
             // tombstone also stops any straggler auto-register from
             // resurrecting the row during shutdown. Compact keeps the
             // session alive, so only the exit path does this.
             if (wrapUp.kind === "exit") {
+              // Watcher deaths run BEFORE the unregister: onSessionDeath
+              // places the death row by the session's chat row, and the
+              // unregister deletes that row. The v2 exit action's emit is
+              // TUI-only (the pump never translates it into a second
+              // death pass, which would erase the placed row), so this is
+              // the exit's only death recording.
+              try {
+                watchers.sessionDied(sessionID, { chatName: db.findChatSession(sessionID)?.name ?? null });
+              } catch (err) {
+                console.error(`[thatch] watcher death recording on exit failed: ${err}`);
+              }
               try {
                 db.unregisterChatSession(sessionID);
               } catch (err) {
@@ -1930,7 +2035,7 @@ export async function createRuntime(input: {
               if (wrapUp.kind === "compact") {
                 await caps.compactSession(sessionID);
               } else {
-                await caps.exitHost();
+                await caps.exitHost(sessionID);
               }
             } catch (err) {
               console.error(`[thatch] wrap-up action failed: ${err}`);

package/src/scoring-engine.ts

@@ -288,13 +288,29 @@ export class ScoringEngine {
 
   createEdge(matcherId: string, itemId: string, weight: number): void {
     const now = new Date().toISOString();
-    const { edgesTable, itemForeignKey } = this.#cfg;
-    this.#db.run(
-      `INSERT INTO ${edgesTable} (matcher_id, ${itemForeignKey}, weight, created_at)
-       VALUES (?, ?, ?, ?)
-       ON CONFLICT(matcher_id, ${itemForeignKey}) DO NOTHING`,
-      [matcherId, itemId, weight, now] as any,
-    );
+    const { edgesTable, itemForeignKey, matchersTable } = this.#cfg;
+    // Insert and bump run atomically: an edge that landed without its
+    // updated_at bump would read as older than it is. bun:sqlite nests
+    // transaction functions via savepoints, so this composes with a
+    // caller's outer transaction (prediction_update's, for one).
+    // Bump only when the insert landed - a re-link to an existing edge
+    // changes nothing.
+    // A matcher's updated_at means "last change to the matcher row or its
+    // edge set" (not "matcher text written"): re-linking a matcher to a
+    // corrected item is graph activity the planned staleness audit must
+    // see. No reader consumes matcher updated_at yet; the bump keeps the
+    // timestamp truthful for when that audit lands.
+    this.#db.transaction(() => {
+      const result = this.#db.run(
+        `INSERT INTO ${edgesTable} (matcher_id, ${itemForeignKey}, weight, created_at)
+         VALUES (?, ?, ?, ?)
+         ON CONFLICT(matcher_id, ${itemForeignKey}) DO NOTHING`,
+        [matcherId, itemId, weight, now] as any,
+      );
+      if (result.changes > 0) {
+        this.#db.run(`UPDATE ${matchersTable} SET updated_at = ? WHERE id = ?`, [now, matcherId] as any);
+      }
+    })();
   }
 
   adjustConfidence(itemId: string, signal: "confirm" | "disconfirm" | "soft"): void {
@@ -349,8 +365,23 @@ export class ScoringEngine {
   }
 
   deleteItem(itemId: string): boolean {
-    const result = this.#db.run(`DELETE FROM ${this.#cfg.itemsTable} WHERE id = ?`, [itemId]);
-    return result.changes > 0;
+    const { itemsTable, edgesTable, itemForeignKey, matchersTable } = this.#cfg;
+    // Bump the matchers whose edges are about to cascade away with the
+    // item (edge rows have ON DELETE CASCADE, so the DELETE below removes
+    // them implicitly). Same updated_at meaning as createEdge: last change
+    // to the matcher row or its edge set. Bump and delete run atomically
+    // (bun:sqlite nests via savepoints): a bump whose delete then failed
+    // would record graph activity that never happened.
+    return this.#db.transaction(() => {
+      const now = new Date().toISOString();
+      this.#db.run(
+        `UPDATE ${matchersTable} SET updated_at = ?
+         WHERE id IN (SELECT matcher_id FROM ${edgesTable} WHERE ${itemForeignKey} = ?)`,
+        [now, itemId] as any,
+      );
+      const result = this.#db.run(`DELETE FROM ${itemsTable} WHERE id = ?`, [itemId]);
+      return result.changes > 0;
+    })();
   }
 
   listItems(store: string): {

package/src/session-tab-shared.ts

@@ -17,10 +17,18 @@
  * The schemas are literal JSON Schema objects because
  * Rpc.PortableEventValueSchema accepts StandardSchemaV1 or a JSON Schema
  * object with type "object"; a literal object keeps this module
- * dependency-free. The tab-closed consumer is live: the v2 pump
- * (src/opencode/v2.ts) translates a confirmed close into the runtime's
- * death path, and the TUI plugin closes the tab - change the shape
- * jointly with both consumers (docs/dev/features/session-tabs.md).
+ * dependency-free. The registration is the server-to-TUI transport for
+ * everything thatch pushes at the TUI (tab lifecycle plus toasts), so its
+ * id says "tabs" only historically. One event has a consumer beyond the
+ * TUI plugin's tab strip: the v2 pump (src/opencode/v2.ts) translates
+ * tab-closed into the runtime's confirmed-death path (the
+ * session_tab_close tool's only route to it), so that shape must change
+ * jointly with all consumers (docs/dev/features/session-tabs.md).
+ * exit-tab-closed is deliberately TUI-only: the wrap-up exit records the
+ * session's watcher deaths synchronously before emitting
+ * (src/runtime.ts), so the pump ignores it - a pump translation would run
+ * the death path a second time and erase the durable death row the first
+ * pass wrote. toast is TUI-only by nature (nobody else consumes it).
  */
 
 import { realpathSync } from "node:fs";
@@ -30,6 +38,8 @@ import { resolveMainCheckout } from "./git";
 export const SESSION_TAB_RPC_ID = "thatch-tabs";
 export const TAB_OPENED_EVENT = "tab-opened";
 export const TAB_CLOSED_EVENT = "tab-closed";
+export const EXIT_TAB_CLOSED_EVENT = "exit-tab-closed";
+export const TOAST_EVENT = "toast";
 
 /** Full wire type of an emitted event, e.g. "rpc.thatch-tabs.tab-opened". */
 export const tabOpenedEventType = `rpc.${SESSION_TAB_RPC_ID}.${TAB_OPENED_EVENT}`;
@@ -38,6 +48,12 @@ export const tabOpenedEventType = `rpc.${SESSION_TAB_RPC_ID}.${TAB_OPENED_EVENT}
  *  heartbeat plan's confirmed-close consumer matches on this. */
 export const tabClosedEventType = `rpc.${SESSION_TAB_RPC_ID}.${TAB_CLOSED_EVENT}`;
 
+/** Full wire type of the wrap-up exit's TUI-only close event. */
+export const exitTabClosedEventType = `rpc.${SESSION_TAB_RPC_ID}.${EXIT_TAB_CLOSED_EVENT}`;
+
+/** Full wire type of the toast request event. */
+export const toastEventType = `rpc.${SESSION_TAB_RPC_ID}.${TOAST_EVENT}`;
+
 export const SESSION_TAB_RPC = {
   id: SESSION_TAB_RPC_ID,
   methods: {},
@@ -67,6 +83,31 @@ export const SESSION_TAB_RPC = {
         additionalProperties: false,
       },
     },
+    [EXIT_TAB_CLOSED_EVENT]: {
+      // TUI-only (see the module header): carries just the tab to close.
+      schema: {
+        type: "object",
+        properties: {
+          sessionID: { type: "string" },
+        },
+        required: ["sessionID"],
+        additionalProperties: false,
+      },
+    },
+    [TOAST_EVENT]: {
+      // TUI-only by nature. The payload is thatch's ToastInput verbatim
+      // (all three fields required there, so required here).
+      schema: {
+        type: "object",
+        properties: {
+          message: { type: "string" },
+          variant: { type: "string", enum: ["info", "success", "warning", "error"] },
+          duration: { type: "number" },
+        },
+        required: ["message", "variant", "duration"],
+        additionalProperties: false,
+      },
+    },
   },
 } as const;
 
@@ -168,6 +209,16 @@ export function isTabClosedEvent(type: string): boolean {
   return type === tabClosedEventType;
 }
 
+/** The wrap-up exit's close filter: same TUI action, no pump translation. */
+export function isExitTabClosedEvent(type: string): boolean {
+  return type === exitTabClosedEventType;
+}
+
+/** The toast-request filter: TUI-only by nature. */
+export function isToastEvent(type: string): boolean {
+  return type === toastEventType;
+}
+
 /**
  * The directory guard mirrors the built-in tui.* handlers: an event only
  * acts on the window whose directory matches the event's location (the

package/src/skills.ts

@@ -1,5 +1,6 @@
 import { mkdirSync, readdirSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { REVIEW_SPECIALISTS } from "./prompts";
 
 export interface SkillDef {
   name: string;
@@ -53,15 +54,10 @@ function loadSharedSkills(): SkillDef[] {
     "thatch-fact-extractor",
     "thatch-dedup-classifier",
     "thatch-project-primer",
-    "thatch-review-pedantic",
-    "thatch-review-acceptance",
-    "thatch-review-state-flow",
-    "thatch-review-economy",
-    "thatch-review-no-slop",
-    "thatch-review-breadcrumbs",
-    "thatch-review-mark-and-sweep",
-    "thatch-review-highlights",
-    "thatch-review-technique",
+    // The specialist roster (order and count) comes from prompts.ts so the
+    // install set and the review-mode commands' inline procedure cannot
+    // diverge.
+    ...REVIEW_SPECIALISTS,
     "thatch-review-synthesizer",
     "thatch-review-context",
     "thatch-code-archaeology",

package/src/tab-state.ts

@@ -0,0 +1,125 @@
+import { readdirSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { CHAT_STALE_MS } from "./chat";
+
+/**
+ * Reader for opencode's per-TUI-instance tab persistence - the roster's
+ * OPEN-vs-RECENT signal. Each opencode TUI window records its open tabs in
+ * `<XDG_STATE_HOME>/opencode/<channel>/tui/tabs.json` (the middle segment is
+ * the release CHANNEL - "latest" today, so a reader must glob, never
+ * hardcode). The file answers "which sessions have a tab right now" for
+ * roster classification and broadcast targeting; it is READ-ONLY here -
+ * the heartbeat stays the only written liveness signal.
+ *
+ * This is a presence refinement, not a truth source. A killed window leaves
+ * its tab rows behind (the file is restart persistence by design), so a row
+ * classified OPEN may occasionally be residue; that trade is accepted in
+ * exchange for zero new writers. With tabs disabled (or no state tree at
+ * all) the reader returns an empty set and every row honestly degrades to
+ * RECENT - never a false OPEN.
+ */
+
+/** Test/QA override for the opencode state root (the directory that holds
+ *  one subdirectory per release channel). Unset means the real location. */
+export const OPEN_TABS_STATE_ROOT_ENV = "THATCH_OPENCODE_STATE_ROOT";
+
+/** The opencode state root: the directory containing one directory per
+ *  release channel ("latest" today). */
+export function openTabsStateRoot(env: Record<string, string | undefined> = process.env): string {
+  const override = env[OPEN_TABS_STATE_ROOT_ENV];
+  if (override) return override;
+  const stateHome = env.XDG_STATE_HOME ?? join(homedir(), ".local", "state");
+  return join(stateHome, "opencode");
+}
+
+/** Shape of tabs.json (opencode v2.0.25, session-tabs storage): an optional
+ *  global section and a per-cwd section, each carrying tab rows with a
+ *  sessionID. Both sections are read because the scope depends on the
+ *  `tabs.scope` config ("cwd" or "global") and the reader must honor both. */
+interface TabsFile {
+  global?: { tabs?: { sessionID?: string }[] };
+  cwd?: Record<string, { tabs?: { sessionID?: string }[] }>;
+}
+
+function collectTabs(rows: { sessionID?: string }[] | undefined, into: Set<string>): void {
+  if (!Array.isArray(rows)) return;
+  for (const row of rows) {
+    if (row && typeof row.sessionID === "string" && row.sessionID) into.add(row.sessionID);
+  }
+}
+
+/**
+ * Every sessionID carrying a tab in ANY channel's tabs.json, from both
+ * scope modes (global section and cwd sections). Per-file failures (no
+ * file, bad JSON, malformed sections) are swallowed and contribute
+ * nothing: a missing or broken signal degrades to empty, never to an
+ * error, so roster rendering and broadcast targeting keep working.
+ */
+export function readOpenTabSessions(stateRoot: string = openTabsStateRoot()): Set<string> {
+  const open = new Set<string>();
+  let channels: string[];
+  try {
+    channels = readdirSync(stateRoot).filter((name) => !name.startsWith("."));
+  } catch {
+    // No state tree (opencode never ran here, or tabs are disabled):
+    // empty set, everything degrades to RECENT.
+    return open;
+  }
+  for (const channel of channels) {
+    let parsed: TabsFile;
+    try {
+      parsed = JSON.parse(readFileSync(join(stateRoot, channel, "tui", "tabs.json"), "utf8"));
+    } catch {
+      continue;
+    }
+    collectTabs(parsed?.global?.tabs, open);
+    const byCwd = parsed?.cwd;
+    if (byCwd && typeof byCwd === "object") {
+      for (const section of Object.values(byCwd)) collectTabs(section?.tabs, open);
+    }
+  }
+  return open;
+}
+
+/** How long a confirmed tab close keeps overriding a residue tab row. The
+ *  close's death path stops the heartbeat, so the row can only read fresh
+ *  until its frozen last_seen crosses CHAT_STALE_MS; one extra poll
+ *  interval covers a beat already in flight at close time. After the
+ *  window the marker is moot (the row is stale regardless), and a session
+ *  that later regains a tab re-derives OPEN from tabs.json alone. */
+export const CHAT_TAB_CLOSED_OVERRIDE_MS = 2 * CHAT_STALE_MS;
+
+/** One confirmed tab close: the session's tab was closed by the
+ *  session_tab tool and the bridge event confirmed it. */
+export interface ChatTabClosure {
+  sessionID: string;
+  /** ISO timestamp of the confirmed close. */
+  at: string;
+}
+
+/**
+ * Subtracts fresh confirmed tab closes from the raw tab set, so a residue
+ * row in tabs.json (a window that died between the tool's close event and
+ * the file write - or before it) cannot read OPEN right after a confirmed
+ * close. Closures older than CHAT_TAB_CLOSED_OVERRIDE_MS are ignored.
+ */
+export function effectiveOpenTabs(openTabs: ReadonlySet<string>, closures: ChatTabClosure[], now = Date.now()): Set<string> {
+  const effective = new Set(openTabs);
+  for (const closure of closures) {
+    const at = Date.parse(closure.at);
+    if (Number.isNaN(at)) continue;
+    if (now - at < CHAT_TAB_CLOSED_OVERRIDE_MS) effective.delete(closure.sessionID);
+  }
+  return effective;
+}
+
+/**
+ * The production open-tabs provider: read tabs.json at call time (never
+ * cached - the file changes between renders) and subtract the confirmed
+ * closes recorded in thatch.db. `loadClosures` is the ThatchDB lookup,
+ * injected so this composes with any database handle.
+ */
+export function chatOpenTabs(loadClosures: () => ChatTabClosure[]): () => Set<string> {
+  return () => effectiveOpenTabs(readOpenTabSessions(), loadClosures());
+}