@maudecode/talaria-web 1.19.0 → 1.21.0

package/dist/sessions/gateway-sessions.js

@@ -1,75 +1,479 @@
-/** One native-owner seam. Talaria observes its history and never settles it into a local Session. */
+import { CHECKPOINT_DIFF_MAX_BYTES, ReactionEmojiSchema, unavailableContextDetail } from '@maudecode/talaria-web-contracts';
+import { checkpointDiffFiles } from '../workspace/rollback.js';
 import { createHash, randomUUID } from 'node:crypto';
-import { GatewaySessionResultSchema } from '@maudecode/talaria-web-contracts';
-import { redactNestedMessageContainers, publicToolFrame } from '../redact.js';
+import { OWNER_EXPORT_MAX_BYTES, SessionNoticeSchema, GatewayClarifyBatchSchema, GatewaySessionResultSchema } from '@maudecode/talaria-web-contracts';
+import { redactNestedMessageContainers, publicToolFrame, redactString } from '../redact.js';
 import { str } from '../util.js';
 import { PendingPrompts } from './pending.js';
+import { wrapExportHtml } from './export.js';
 import { clarifyReply } from './pending.js';
 import { HttpFailure } from './service.js';
+import { SessionNotices } from './notices.js';
 import { SessionEventBus } from './events.js';
 import { messageWindowForDisplay, messagesForLimitedPayload } from './window.js';
 import { pendingUserRow } from './merge.js';
-import { CANONICAL_READ_ONLY_REASON } from './state-db.js';
+import { ReasoningTitleTracker, reasoningEventPayload } from './reasoning-titles.js';
+import { CANONICAL_READ_ONLY_REASON, WEB_DIAGNOSTIC_REQUEST_PREFIX } from './state-db.js';
+import { toolProgress } from './tool-display.js';
 const ownerStreamPrefix = (home) => `owner-${createHash('sha256').update(home).digest('hex').slice(0, 16)}-`;
 const ownerStateId = (identity) => `owner-${createHash('sha256').update(identity).digest('hex')}`;
 /** The scope remains verifiable after a server restart, before a journal lookup or stream subscription. */
 export const gatewayStreamVisible = (stream, home) => !stream.startsWith('owner-') || stream.startsWith(ownerStreamPrefix(home));
+/** The server's one classification of why an owner cannot start a diagnostic chat; clients word the code. */
+function unavailableReason(result) {
+    if (result.state === 'stopped')
+        return 'gateway_stopped';
+    if (result.reason === 'served_profile_sessions_unavailable')
+        return 'served_profile';
+    if (result.state === 'incompatible')
+        return 'agent_unsupported';
+    return 'gateway_unavailable';
+}
 /** A preview can be absent in a valid native receipt; only original nonblank text can become a retry draft. */
 function retryText(admission) {
     const text = admission.text;
     return typeof text === 'string' && text.trim() ? text : null;
 }
+/** Steering belongs to the current turn; it must never replace that turn's transcript anchor. */
+const runningAdmission = (snapshot) => snapshot.pending.find((p) => p.status === 'started' && !p.steering);
+const sameExecution = (a, b) => a.authority_epoch === b.authority_epoch && a.replay_epoch === b.replay_epoch && a.execution_generation === b.execution_generation;
+/** Native counters and the owner's compact turn-end usage share one existing Web usage shape. */
+function ownerUsage(data) {
+    const fields = {
+        input_tokens: ['prompt_tokens', 'prompt', 'input_tokens', 'input'], output_tokens: ['completion_tokens', 'completion', 'output_tokens', 'output'],
+        cache_read_tokens: ['cache_read_tokens'], cache_write_tokens: ['cache_write_tokens'],
+        estimated_cost: ['estimated_cost_usd'], last_prompt_tokens: ['last_prompt_tokens', 'context_used'],
+        context_length: ['context_length', 'context_max'], cache_hit_percent: ['cache_hit_pct'], tps: ['tokens_per_s', 'avg_tps'],
+    };
+    const usage = {};
+    for (const [field, keys] of Object.entries(fields)) {
+        const value = keys.map((key) => data[key]).find((value) => typeof value === 'number' && Number.isFinite(value) && value >= 0);
+        if (value !== undefined)
+            usage[field] = value;
+    }
+    return usage;
+}
+/** Translate only owner-confirmed outcomes; an unknown receipt never means applied. */
+function modelChange(receipt, selection = {}) {
+    const payload = receipt.payload && typeof receipt.payload === 'object' ? receipt.payload : selection;
+    const model = str(receipt.target_model) || str(payload.model) || str(receipt.model);
+    const provider = Object.hasOwn(receipt, 'target_provider') ? receipt.target_provider : payload.provider;
+    const target = { ...(model ? { model } : {}), ...(provider === null || typeof provider === 'string' ? { provider } : {}) };
+    if (receipt.operation !== 'model')
+        return { state: 'refused', message: 'The owner did not confirm the model change' };
+    if (receipt.status === 'deferred')
+        return { state: 'deferred', ...target };
+    if (receipt.status === 'confirmation_required' && typeof receipt.confirm === 'string' && receipt.confirm && model)
+        return { state: 'confirmation_required', message: str(receipt.confirm_message), confirm: receipt.confirm, ...target };
+    if (receipt.status === undefined && Number.isInteger(receipt.revision))
+        return { state: 'applied' };
+    return { state: 'refused', message: str(receipt.reason || receipt.message) || 'The owner did not confirm the model change' };
+}
 export class GatewaySessions {
     deps;
     watches = new Map();
+    runWorkers = new Set();
+    observations = new Map();
+    noticeEpochs = new Map();
+    notices;
+    modelMutations = new Map();
+    modelChanges = new Map();
+    rememberModelChange(target, snapshot, change) {
+        this.modelChanges.set(target.key, { epoch: snapshot.authority_epoch, replay: snapshot.replay_epoch, change });
+    }
+    currentModelChange(target, snapshot) {
+        const saved = this.modelChanges.get(target.key);
+        if (!saved || !snapshot)
+            return undefined;
+        if (saved.epoch === snapshot.authority_epoch && saved.replay === snapshot.replay_epoch)
+            return saved.change;
+        this.modelChanges.delete(target.key);
+        return undefined;
+    }
     constructor(deps) {
         this.deps = deps;
+        this.notices = new SessionNotices(deps.now);
+    }
+    addNativeNotice(target, key, frame) {
+        const text = typeof frame.text === 'string' ? frame.text.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, '') : '';
+        this.notices.add(target.key, { ...frame, key, text, lapses_with_agent: true });
+    }
+    noticeState(target, snapshot, reset = false) {
+        const identity = ownerStateId(JSON.stringify([target.key, snapshot.authority_epoch, snapshot.replay_epoch]));
+        let state = this.noticeEpochs.get(target.key);
+        if (state?.identity !== identity || reset) {
+            this.notices.reset(target.key);
+            state = { identity, sequence: reset ? snapshot.last_sequence : 0 };
+            this.noticeEpochs.set(target.key, state);
+        }
+        const warning = typeof snapshot.info.config_warning === 'string' ? snapshot.info.config_warning : '';
+        if (warning.trim())
+            this.addNativeNotice(target, `${identity}:config-warning`, { text: warning, level: 'warn' });
+        return state;
+    }
+    nativeNotices(target, snapshot) {
+        const observed = this.observations.get(target.key)?.snapshot;
+        this.noticeState(target, observed && observed.authority_epoch >= snapshot.authority_epoch ? observed : snapshot);
+        // A detail row may already contain our projection. Read the direct layer itself so
+        // retained transport bases cannot duplicate warnings or resurrect cleared notices.
+        const direct = SessionNoticeSchema.array().safeParse(this.deps.service.deps.runtime.sessionNotices?.(target.sid) ?? []);
+        return [...(direct.success ? direct.data : []), ...this.notices.list(target.key)];
+    }
+    changed(target) {
+        this.deps.channels.emit(target.sid, 'session-updated', { session_id: target.sid, source: 'native_owner' }, target.profile);
+    }
+    /** One shared connection, acquired by viewers and run projections, with no local Agent admission. */
+    transport(target, base, snapshot) {
+        const prior = this.observations.get(target.key);
+        if (prior && !prior.controller.signal.aborted)
+            return prior;
+        const observation = { controller: new AbortController(), snapshot, replaying: true, completion: null, listeners: new Set(), leases: 0, ended: Promise.resolve({ state: 'unavailable', reason: 'owner_connection_lost', snapshot: null, receipt: null }) };
+        this.observations.set(target.key, observation);
+        this.noticeState(target, snapshot);
+        observation.ended = (async () => {
+            const showReasoning = await this.deps.showReasoning(target.home).catch(() => false);
+            const sidecar = this.deps.sidecar();
+            if (!sidecar || observation.controller.signal.aborted)
+                return { state: 'unavailable', reason: 'sidecar_unavailable', snapshot: null, receipt: null };
+            return sidecar.call('gateway.session', { profile_home: target.home, session_id: target.sid, action: 'watch', show_reasoning: showReasoning }, {
+                signal: observation.controller.signal, timeoutMs: 0,
+                onStream: (frame) => {
+                    if (observation.controller.signal.aborted || this.observations.get(target.key) !== observation)
+                        return;
+                    if (frame.event === 'snapshot') {
+                        const result = GatewaySessionResultSchema.parse(frame.data);
+                        if (result.snapshot?.session_id !== target.sid)
+                            return;
+                        // Reaction readback invalidates display data only. Queued native turn events still own settlement.
+                        if (frame.data.reaction_only === true) {
+                            this.changed(target);
+                            return;
+                        }
+                        const completed = observation.completion?.data;
+                        if (result.replay_gap || completed && (completed.authority_epoch !== result.snapshot.authority_epoch || completed.replay_epoch !== result.snapshot.replay_epoch))
+                            observation.completion = null;
+                        observation.snapshot = result.snapshot;
+                        observation.replaying = frame.data.replaying === true;
+                        this.noticeState(target, result.snapshot, result.replay_gap === true);
+                        if ((result.snapshot.running || result.snapshot.pending.some((p) => p.status === 'queued' || p.status === 'started')) && !this.watches.has(target.key))
+                            this.watch(target, base, result.snapshot);
+                        this.changed(target);
+                    }
+                    else if (frame.event === 'replay_complete') {
+                        observation.replaying = false;
+                    }
+                    else if (frame.event === 'event') {
+                        const event = frame.data;
+                        const data = (event.payload ?? {});
+                        if (event.type === 'notification.show' || event.type === 'notification.clear') {
+                            const snap = observation.snapshot;
+                            const state = this.noticeState(target, snap);
+                            if (event.session_id !== target.sid || event.replay_epoch !== snap.replay_epoch
+                                || event.authority_epoch !== undefined && event.authority_epoch !== snap.authority_epoch
+                                || !Number.isSafeInteger(event.seq) || Number(event.seq) <= state.sequence)
+                                return;
+                            state.sequence = Number(event.seq);
+                            const key = typeof data.key === 'string' ? data.key : typeof data.id === 'string' ? data.id : '';
+                            if (!key)
+                                return;
+                            const scopedKey = `${state.identity}:plugin:${ownerStateId(key)}`;
+                            if (event.type === 'notification.clear')
+                                this.notices.clear(target.key, scopedKey);
+                            else
+                                this.addNativeNotice(target, scopedKey, data);
+                            this.changed(target);
+                        }
+                        else if (event.type === 'session.info') {
+                            if (data.authority_epoch !== observation.snapshot.authority_epoch || Number(data.execution_generation) < observation.snapshot.execution_generation)
+                                return;
+                            observation.snapshot = { ...observation.snapshot, ...data };
+                            if ((observation.snapshot.running || observation.snapshot.pending.some((p) => p.status === 'queued' || p.status === 'started')) && !this.watches.has(target.key))
+                                this.watch(target, base, observation.snapshot);
+                            this.changed(target);
+                        }
+                        else if (event.type === 'message.complete' && event.session_id === target.sid
+                            && event.authority_epoch === observation.snapshot.authority_epoch && event.replay_epoch === observation.snapshot.replay_epoch
+                            && Number.isSafeInteger(event.execution_generation) && Number(event.execution_generation) >= observation.snapshot.execution_generation) {
+                            observation.completion = frame;
+                        }
+                        else if (event.type === 'session.updated')
+                            this.changed(target);
+                    }
+                    for (const listener of observation.listeners)
+                        listener(frame);
+                },
+            });
+        })().catch(() => ({ state: 'unavailable', reason: 'owner_connection_lost', snapshot: null, receipt: null })).finally(() => {
+            observation.controller.abort();
+            if (this.observations.get(target.key) === observation)
+                this.observations.delete(target.key);
+            this.changed(target);
+        });
+        return observation;
+    }
+    lease(observation) {
+        observation.leases++;
+        let held = true;
+        return () => { if (!held)
+            return; held = false; if (--observation.leases === 0)
+            observation.controller.abort(); };
     }
-    target(sid, profile = this.deps.activeProfile()) {
+    /** Called only after the existing HTTP owner has authorized and claimed a viewer's stream slot. */
+    async observe(sid, profile, signal) {
+        const target = await this.target(sid, profile);
+        if (!target || signal.aborted)
+            return null;
+        const base = await this.deps.service.detail(sid, {});
+        const result = await this.call(target, { action: 'snapshot' }, signal);
+        if (signal.aborted)
+            return null;
+        if (!result.snapshot || result.state !== 'attached')
+            return { release: () => undefined, ended: Promise.resolve(result) };
+        const observation = this.transport(target, base, result.snapshot);
+        const release = this.lease(observation);
+        signal.addEventListener('abort', release, { once: true });
+        return { release: () => { signal.removeEventListener('abort', release); release(); }, ended: observation.ended };
+    }
+    async target(sid, profile = this.deps.activeProfile(), requireKnownOwnership = false) {
         if (sid.length === 0 || sid !== sid.trim())
             return null;
-        const owner = this.deps.service.stateDbSources([sid], profile)?.get(sid);
+        const sources = await this.deps.service.stateDbSources([sid], profile);
+        if (requireKnownOwnership && !sources)
+            throw new HttpFailure(503, 'Agent session ownership could not be verified');
+        const owner = sources?.get(sid);
         if (typeof owner !== 'object')
             return null;
-        if (owner.reason)
+        if (owner.reason) {
+            if (requireKnownOwnership)
+                throw new HttpFailure(403, owner.reason);
             return null;
+        }
         const home = this.deps.profileHome(profile);
         return { sid, profile, home, key: JSON.stringify([home, sid]) };
     }
-    isOwned(sid) { return this.target(sid) !== null; }
-    async call(target, params) {
+    async contextDetail(sid, expectedKey) {
+        const profile = this.deps.activeProfile();
+        const target = await this.target(sid, profile);
+        if (!target)
+            return unavailableContextDetail();
+        const result = await this.call(target, { action: 'context_detail' });
+        return profile === this.deps.activeProfile() && result.state === 'attached' && this.contextDetailKey(target, result.snapshot) === expectedKey ? result.context_detail ?? unavailableContextDetail('unsupported') : unavailableContextDetail('changed');
+    }
+    activityPhaseFor(result, target) {
+        if (result.state !== 'attached' || !result.snapshot)
+            return 'stale';
+        const pending = this.prompts(result.snapshot, target.sid, this.batch(target));
+        if (pending.approvalPending(target.sid).pending)
+            return 'waiting_for_approval';
+        if (pending.clarifyPending(target.sid).pending)
+            return 'waiting_for_input';
+        if (result.snapshot.running || result.snapshot.pending.some((entry) => entry.status === 'queued' || entry.status === 'started'))
+            return 'running';
+        return result.snapshot.pending.some((entry) => entry.status === 'unknown') ? 'stale' : null;
+    }
+    async activityPhase(sid, profile) {
+        const target = await this.target(sid, profile);
+        return target ? this.activityPhaseFor(await this.call(target, { action: 'snapshot' }), target) : undefined;
+    }
+    async isOwned(sid) { return (await this.target(sid)) !== null; }
+    /** Exact native receipt lookup for a durable queue step, never another submit. */
+    async queueReceipt(sid, admissionId) {
+        const target = await this.target(sid);
+        return target ? this.call(target, admissionId ? { action: 'receipt', admission_id: admissionId } : { action: 'snapshot' }) : null;
+    }
+    async checkpointDiff(sid) {
+        const profile = this.deps.activeProfile();
+        const target = await this.target(sid, profile);
+        if (!target)
+            return null;
+        const result = await this.call(target, { action: 'checkpoint_diff' });
+        const read = profile === this.deps.activeProfile() && result.state === 'attached' ? result.checkpoint_diff : undefined;
+        const comparison = read ? { ...read.comparison } : { provenance: 'native_owner', baseline: 'earliest_retained_project_checkpoint', available: false, reason: 'owner_unavailable', truncated: false };
+        if (read && (Buffer.byteLength(JSON.stringify(read.diff), 'utf8') + Buffer.byteLength(JSON.stringify(read.stat), 'utf8') - 4 > CHECKPOINT_DIFF_MAX_BYTES)) {
+            comparison.available = false;
+            comparison.reason = 'payload_too_large';
+        }
+        const diff = comparison.available ? read?.diff ?? '' : '';
+        const files = checkpointDiffFiles(diff);
+        return { checkpoint: 'earliest-retained', workspace: '', diff: diff.trimEnd(), files_changed: files, total_changes: files.length, comparison };
+    }
+    terminalKey(target, snap) {
+        return ownerStateId(JSON.stringify([target.key, snap.session_id, snap.authority_epoch, snap.replay_epoch, snap.info.cwd]));
+    }
+    async terminal(sid) {
+        const target = await this.target(sid, this.deps.activeProfile(), true);
+        if (!target)
+            return null;
+        const result = await this.call(target, { action: 'terminal_info' });
+        const snap = result.snapshot;
+        if (target.profile !== this.deps.activeProfile() || result.state !== 'attached' || snap?.session_id !== sid)
+            throw new HttpFailure(409, 'The native owner cannot run captured commands. Reopen the terminal after checking the gateway.', { code: 'owner_shell_unavailable' });
+        return { target, snap, key: this.terminalKey(target, snap) };
+    }
+    async capturedCommand(sid, key, command) {
+        const selected = await this.terminal(sid);
+        if (key !== selected?.key)
+            throw new HttpFailure(409, 'The native owner changed. Reopen the terminal before running a command.');
+        const { target, snap } = selected;
+        const result = await this.call(target, { action: 'shell_exec', command, authority_epoch: snap.authority_epoch, replay_epoch: snap.replay_epoch });
+        if (result.state !== 'attached' || !result.shell) {
+            // Only allowlisted native policy refusals are safe to show. A transport failure may have executed.
+            const messages = {
+                unsupported_terminal_backend: 'Captured commands require the native owner’s local terminal backend.',
+                cwd_unavailable: 'The native workspace no longer exists.', dangerous_command: 'The native owner refused this command.',
+                permission_denied: 'The native owner denied this command.', command_timeout: 'The command timed out on the native owner.',
+                owner_changed: 'The native owner changed. Reopen the terminal.',
+            };
+            throw new HttpFailure(409, messages[result.reason ?? ''] ?? 'The command outcome is unknown. Check the native workspace before running it again.', { code: 'owner_shell_failed' });
+        }
+        return { stdout: redactString(result.shell.stdout, true), stderr: redactString(result.shell.stderr, true), code: result.shell.code };
+    }
+    async export(sid, format) {
+        const target = await this.target(sid);
+        if (!target)
+            return null;
+        const redact = this.deps.redactEnabled();
+        const result = await this.call(target, { action: 'export', format, redact });
+        const value = result.export;
+        if (result.reason === 'export_too_large')
+            throw new HttpFailure(413, 'The owner transcript exceeds the export limit');
+        if (result.state !== 'attached' || value?.format !== format) {
+            throw new HttpFailure(409, 'The Agent owner cannot export this chat. Check that its gateway is running and supports transcript export.', { code: 'owner_export_unavailable' });
+        }
+        if (Buffer.byteLength(value.content, 'utf8') > OWNER_EXPORT_MAX_BYTES)
+            throw new HttpFailure(413, 'The owner transcript exceeds the export limit');
+        let content;
+        try {
+            // The owner redacts HTML's structured transcript before rendering. A shell/text redactor corrupts its markup.
+            content = format === 'html' ? wrapExportHtml(value.content) : format === 'json'
+                ? JSON.stringify(redactNestedMessageContainers(JSON.parse(value.content), redact), null, 2)
+                : redactString(value.content, redact);
+        }
+        catch {
+            throw new HttpFailure(409, 'The Agent owner returned an invalid transcript export', { code: 'owner_export_invalid' });
+        }
+        if (Buffer.byteLength(content, 'utf8') > OWNER_EXPORT_MAX_BYTES)
+            throw new HttpFailure(413, 'The owner transcript exceeds the export limit');
+        return { ...value, content };
+    }
+    async createCall(params) {
         const sidecar = this.deps.sidecar();
         if (!sidecar)
             return { state: 'unavailable', reason: 'sidecar_unavailable', snapshot: null, receipt: null };
         try {
-            return await sidecar.call('gateway.session', { ...params, profile_home: target.home, session_id: target.sid }, { timeoutMs: params.action === 'mutate' ? 675_000 : 35_000 });
+            return await sidecar.call('gateway.create', params, { timeoutMs: 35_000 });
         }
         catch {
             return { state: 'unavailable', reason: 'owner_connection_lost', snapshot: null, receipt: null };
         }
     }
+    /** TAL-1040: normal always runs; the bypass modes need an owner that freezes them before any Agent import. */
+    async modes(profile) {
+        const result = await this.createCall({ profile_home: this.deps.profileHome(profile), probe: true });
+        const reason = result.state === 'attached' ? null : unavailableReason(result);
+        // Owner chats take no file attachments (`submit` refuses them), so a fresh chat in either bypass mode cannot attach.
+        return { modes: [{ mode: 'normal', available: true, reason: null, can_attach: true, can_reference: true }, ...['ignore_config', 'safe'].map((mode) => ({ mode, available: reason === null, reason, can_attach: false, can_reference: false }))] };
+    }
+    /**
+     * TAL-1040: the owner mints a diagnostic chat, freezes its bypass in the creation receipt and runs each turn in a fresh
+     * private worker. Talaria keeps no local Session and never falls back to an ordinary chat; no credential is sent.
+     */
+    async create(profile, creationId, params) {
+        // The client's creation id survives a lost response, so a retry recovers the owner's committed session, never a second one.
+        const result = await this.createCall({ ...params, profile_home: this.deps.profileHome(profile), request_id: WEB_DIAGNOSTIC_REQUEST_PREFIX + (creationId ?? randomUUID()) });
+        if (result.state !== 'attached' || !result.snapshot) {
+            throw new HttpFailure(409, 'The Agent cannot start a chat in this mode', { code: 'execution_mode_unavailable', reason: unavailableReason(result) });
+        }
+        return result.snapshot.session_id;
+    }
+    async call(target, params, signal) {
+        const sidecar = this.deps.sidecar();
+        if (!sidecar)
+            return { state: 'unavailable', reason: 'sidecar_unavailable', snapshot: null, receipt: null };
+        const before = this.modelChanges.get(target.key);
+        const modelMutation = params.action === 'mutate' && params.operation === 'model';
+        if (modelMutation)
+            this.modelMutations.set(target.key, (this.modelMutations.get(target.key) ?? 0) + 1);
+        try {
+            const result = await sidecar.call('gateway.session', { ...params, profile_home: target.home, session_id: target.sid }, { timeoutMs: params.action === 'mutate' ? 675_000 : params.action === 'shell_exec' ? 40_000 : 35_000, ...(signal ? { signal } : {}) });
+            if (params.action === 'mutate' && params.operation === 'model' && result.snapshot) {
+                const change = modelChange(result.receipt ?? {}, params.payload);
+                // The stream can resolve a deferred pick before its HTTP ACK returns. Keep the later observation.
+                if (change.state !== 'deferred' || this.modelChanges.get(target.key) === before
+                    || !this.currentModelChange(target, result.snapshot))
+                    this.rememberModelChange(target, result.snapshot, change);
+            }
+            const change = this.currentModelChange(target, result.snapshot);
+            return { ...result, ...(change ? { model_change: change } : {}) };
+        }
+        catch {
+            return { state: 'unavailable', reason: 'owner_connection_lost', snapshot: null, receipt: null };
+        }
+        finally {
+            if (modelMutation) {
+                const remaining = (this.modelMutations.get(target.key) ?? 1) - 1;
+                if (remaining)
+                    this.modelMutations.set(target.key, remaining);
+                else {
+                    this.modelMutations.delete(target.key);
+                    this.watches.get(target.key)?.reconcile?.();
+                }
+            }
+        }
+    }
     attachment(result) {
         const snapshot = result.snapshot;
         const unknown = snapshot?.pending.some((p) => p.status === 'unknown') ?? false;
+        const restarting = result.restarting === true;
         const value = {
-            state: result.state, reason: result.reason, can_submit: result.state === 'attached' && snapshot !== null && !unknown,
+            state: result.state, reason: result.reason, restarting, can_submit: result.state === 'attached' && snapshot !== null && !unknown && !restarting,
             can_interrupt: result.state === 'attached' && snapshot?.running === true, can_attach: false,
             revision: snapshot?.revision ?? null, execution_generation: snapshot?.execution_generation ?? null,
-            active_admission: snapshot?.pending.find((p) => p.status === 'started') ?? null,
+            ...(result.model_change ? { model_change: result.model_change } : {}),
+            active_admission: snapshot ? runningAdmission(snapshot) ?? null : null,
             admissions: (snapshot?.pending ?? []).filter((p) => p.status === 'queued' || p.status === 'unknown').map((p) => ({ ...p,
-                actions: p.status === 'queued' ? ['cancel']
+                actions: p.status === 'queued' ? ['cancel', ...(p.controls?.includes('steer') ? ['steer'] : []), ...(p.controls?.includes('replace') ? ['edit'] : [])]
                     : p.execution_generation === null ? []
                         : retryText(p) === null ? ['discard'] : ['retry', 'discard'],
             })),
         };
         return redactNestedMessageContainers(value, this.deps.redactEnabled());
     }
+    contextDetailKey(target, snapshot) {
+        return snapshot ? ownerStateId(JSON.stringify([target.key, snapshot.authority_epoch, snapshot.replay_epoch, snapshot.revision, snapshot.execution_generation, snapshot.info, snapshot.last_sequence])) : null;
+    }
+    reactionView(row, allowed) {
+        if (!Number.isSafeInteger(row.row_id) || Number(row.row_id) <= 0 || !['user', 'assistant'].includes(str(row.role)))
+            return undefined;
+        const authors = new Map();
+        for (const raw of Array.isArray(row.reactions) ? row.reactions : []) {
+            const reaction = raw;
+            const emoji = ReactionEmojiSchema.safeParse(reaction?.emoji);
+            if (emoji.success && (reaction.author === 'user' || reaction.author === 'agent'))
+                authors.set(reaction.author, emoji.data);
+        }
+        const state = (selected) => {
+            const values = [authors.get('agent'), selected].filter((emoji) => emoji !== undefined && emoji !== null);
+            return { selected, items: ReactionEmojiSchema.options.flatMap((emoji) => {
+                    const count = values.filter((value) => value === emoji).length;
+                    return count ? [{ emoji, count, mine: selected === emoji }] : [];
+                }) };
+        };
+        const selected = authors.get('user') ?? null;
+        return { row_id: Number(row.row_id), state: state(selected), actions: allowed
+                ? [...ReactionEmojiSchema.options, ...(selected ? [null] : [])].map((emoji) => ({ emoji, result: state(emoji === selected ? null : emoji) })) : [] };
+    }
     async view(base, result, stream, target, limit = 120, before = null, withMessages = true) {
         const snapshot = result.snapshot;
-        const fields = { ...base, owner_attachment: this.attachment(result), composer_state_key: ownerStateId(target.key), active_stream_id: stream, is_streaming: Boolean(stream) };
+        const fields = { ...base, owner_attachment: this.attachment({ ...result, model_change: this.currentModelChange(target, snapshot) }), composer_state_key: ownerStateId(target.key), context_detail_key: this.contextDetailKey(target, snapshot), active_stream_id: stream, is_streaming: Boolean(stream) };
         if (snapshot) {
-            const nativeRows = [...snapshot.messages];
-            const active = stream ? snapshot.pending.find((p) => p.status === 'started') : null;
+            fields.notices = this.nativeNotices(target, snapshot);
+            const observed = this.watches.get(target.key)?.snapshot;
+            const canReact = snapshot.reactions_supported === true && this.attachment(result).can_submit;
+            const nativeRows = snapshot.messages.map(({ reactions, ...row }) => ({ ...row,
+                reaction_view: this.reactionView({ ...row, reactions }, canReact),
+            }));
+            const active = stream ? runningAdmission(snapshot) : null;
             let start = active ? nativeRows.findIndex((m) => m.role === 'user' && m.message_id === active.admission_id) : -1;
             if (active && stream && start < 0) {
                 start = nativeRows.length;
@@ -86,6 +490,8 @@ export class GatewaySessions {
                 model_provider: provider, model_option_id: this.deps.service.deps.modelOptionFor?.(model, provider) ?? null,
                 workspace: str(snapshot.info.cwd) || base.workspace, active_stream_id: stream, is_streaming: Boolean(stream), agent_running: snapshot.running,
                 transcript_seq: stream ? { stream_id: stream, seq: 0 } : null,
+                tool_calls: withMessages && before === null && stream && snapshot.running && observed && sameExecution(snapshot, observed)
+                    ? this.deps.service.deps.runtime.liveToolProgress?.(stream) ?? [] : [],
             });
             fields.workspace_name = (await this.deps.service.workspaceNames([fields]))(fields);
         }
@@ -95,7 +501,7 @@ export class GatewaySessions {
         // The wire's existing owner lock already classified ordinary sessions, including cached pages.
         if (base.read_only_reason !== CANONICAL_READ_ONLY_REASON)
             return base;
-        const target = this.target(str(base.session_id), str(base.profile) || this.deps.activeProfile());
+        const target = await this.target(str(base.session_id), str(base.profile) || this.deps.activeProfile());
         if (!target)
             return base;
         const result = await this.call(target, { action: 'snapshot' });
@@ -109,8 +515,8 @@ export class GatewaySessions {
         return this.view(base, result, watch?.stream ?? null, target, limit, before, withMessages);
     }
     /** Called before the direct-chat admission path, including for an already materialized foreign session. */
-    async submit(sid, body) {
-        const target = this.target(sid);
+    async submit(sid, body, timing, fence) {
+        const target = await this.target(sid);
         if (!target)
             return null;
         const text = str(body.message).trim();
@@ -118,7 +524,9 @@ export class GatewaySessions {
             throw new HttpFailure(400, 'message is required');
         // Native policy is frozen by its owner. Changing model/workspace travels through session.mutate,
         // never through a hidden per-turn override or the local Agent setup path.
+        const closeSnapshot = timing?.begin('owner_snapshot');
         const before = await this.call(target, { action: 'snapshot' });
+        closeSnapshot?.(before.state === 'unavailable' ? 'unknown' : before.state === 'attached' ? 'ok' : 'refused');
         if (!this.attachment(before).can_submit)
             throw new HttpFailure(before.state === 'attached' ? 409 : 403, 'The owning Agent is unavailable or needs an explicit recovery decision', { owner_attachment: this.attachment(before) });
         if (typeof body.submission_id !== 'string' || !body.submission_id || body.submission_id.length > 128)
@@ -126,17 +534,29 @@ export class GatewaySessions {
         if (Array.isArray(body.attachments) && body.attachments.length)
             throw new HttpFailure(400, 'File attachments are unavailable through this owner connection', { code: 'owner_attachments_unavailable' });
         // Resolve display state before admission; a failed post-ACK read must never turn accepted work into a refusal.
-        const base = await this.deps.service.detail(sid, {});
+        const base = await (timing ? timing.measure('owner_detail', () => this.deps.service.detail(sid, {})) : this.deps.service.detail(sid, {}));
+        if (fence && (!this.deps.service.deps.profilesMatch(str(base.profile) || null, fence.profile) || (str(base.project_id) || null) !== fence.project_id || before.snapshot?.authority_epoch !== fence.authority_epoch || before.snapshot.running || before.snapshot.pending.some((p) => p.status !== 'terminal')))
+            throw new HttpFailure(409, 'Queue target changed or is busy');
+        const closeSubmit = timing?.begin('owner_submit');
         const result = await this.call(target, { action: 'submit', request_id: body.submission_id, text });
-        if (!result.receipt)
+        closeSubmit?.(result.receipt ? 'ok' : result.state === 'unavailable' ? 'unknown' : 'refused');
+        if (result.state === 'attached' && result.snapshot && result.receipt?.voice_stopped === true) {
+            const watch = this.watches.get(target.key);
+            return { ok: true, status: 'suppressed', reason: 'voice_stopped', session_id: sid,
+                owner_attachment: this.attachment(result), session: await this.view(base, result, watch?.stream ?? null, target) };
+        }
+        if (!result.receipt || !('admission_id' in result.receipt))
             throw new HttpFailure(409, 'The owner did not confirm this admission. Reconcile it before resending.', { owner_attachment: this.attachment(result), outcome_unknown: result.state === 'unavailable' });
         const snapshot = result.snapshot;
-        const watch = snapshot && (snapshot.running || snapshot.pending.some((p) => p.status === 'queued' || p.status === 'started')) ? this.watches.get(target.key) ?? this.watch(target, base, snapshot) : null;
+        // A fast refusal can settle before submit returns; its retained completion still belongs to this input.
+        const refused = result.receipt.status === 'terminal' && result.receipt.outcome === 'failed';
+        const watch = snapshot && (refused || snapshot.running || snapshot.pending.some((p) => p.status === 'queued' || p.status === 'started'))
+            ? this.watches.get(target.key) ?? this.watch(target, base, snapshot, refused ? str(result.receipt.admission_id) : undefined) : null;
         this.deps.events.publish('owner_admission', { profile: target.profile, sessionId: sid });
         return { session_id: sid, ...(watch ? { stream_id: watch.stream, turn_id: watch.stream } : {}), owner_attachment: this.attachment(result), admission_id: result.receipt.admission_id, session: await this.view(base, result, watch?.stream ?? null, target) };
     }
     async action(sid, params) {
-        const target = this.target(sid);
+        const target = await this.target(sid);
         if (!target)
             throw new HttpFailure(403, 'This session has no canonical owner');
         if (params.action === 'mutate' && params.operation === 'workspace') {
@@ -147,15 +567,30 @@ export class GatewaySessions {
                 throw new HttpFailure(400, 'The workspace must be trusted before selecting it');
             }
         }
-        const result = await this.call(target, params);
+        if (params.action === 'react') {
+            const current = await this.call(target, { action: 'snapshot' });
+            const row = current.snapshot?.messages.find((row) => row.row_id === params.row_id);
+            if (!row || current.snapshot?.reactions_supported !== true || !this.attachment(current).can_submit
+                || !['user', 'assistant'].includes(str(row.role)))
+                throw new HttpFailure(409, 'Reactions are unavailable for this message');
+        }
+        let result = await this.call(target, params);
+        if (params.action === 'react' && result.state === 'unavailable') {
+            // A toggle has no idempotency key. Read the owner after a lost ACK; never replay the write.
+            result = await this.call(target, { action: 'snapshot' });
+            if (result.state !== 'attached' || !result.snapshot)
+                throw new HttpFailure(503, 'Could not confirm the reaction. Reconnect to read its current value.', { outcome_unknown: true });
+        }
         if (result.state !== 'attached' || !result.snapshot)
             throw new HttpFailure(409, 'The owning Agent refused the action', { owner_attachment: this.attachment(result) });
+        if (params.action === 'react')
+            this.changed(target);
         this.deps.events.publish('owner_changed', { profile: target.profile, sessionId: sid });
         return result;
     }
     /** The display preview is redacted; an explicit retry returns the original text for review, like direct-chat retry. */
     async retry(sid, admissionId, generation) {
-        const target = this.target(sid);
+        const target = await this.target(sid);
         if (!target)
             throw new HttpFailure(403, 'This session has no canonical owner');
         const current = await this.call(target, { action: 'snapshot' });
@@ -168,7 +603,7 @@ export class GatewaySessions {
         await this.action(sid, { action: 'discard', admission_id: admissionId, execution_generation: generation });
         return text;
     }
-    prompts(snapshot, sid) {
+    prompts(snapshot, sid, batch) {
         const pending = new PendingPrompts(new SessionEventBus(), this.deps.now);
         for (const prompt of snapshot?.prompts ?? []) {
             const data = { ...prompt, session_id: sid, request_id: prompt.prompt_id, timeout_seconds: 0, allowed_choices: prompt.choices, can_enable_yolo: false };
@@ -177,25 +612,56 @@ export class GatewaySessions {
             else if (prompt.kind === 'clarify')
                 pending.submitClarify(sid, { ...data, clarify_id: prompt.prompt_id });
         }
+        // A fully locked batch waits only for the owner's withdrawal; nothing is left to ask.
+        if (batch?.remaining.length) {
+            const entry = pending.submitClarify(sid, { session_id: sid, clarify_id: batch.request_id, request_id: batch.request_id, timeout_seconds: 0, questions: batch.questions });
+            for (const step of entry.steps)
+                step.answered = !batch.remaining.includes(step.qid);
+        }
         return pending;
     }
+    /** The batch the target's live watch received; the owner asks it once, of the viewers attached when it parks. */
+    batch(target) { return this.watches.get(target.key)?.batch ?? null; }
+    /** Locks each answer; the owner settles the batch on the lock that leaves nothing open. */
+    async lockBatch(target, batch, answers) {
+        for (const [qid, answer] of Object.entries(answers)) {
+            const result = await this.call(target, { action: 'clarify_lock', request_id: batch.request_id, question_id: qid, answer: Array.isArray(answer) ? JSON.stringify(answer) : answer });
+            if (result.state === 'attached' && result.lock?.status === 'ok') {
+                batch.remaining = result.lock.remaining ?? [];
+                continue;
+            }
+            if (result.lock?.status === 'expired')
+                batch.remaining = [];
+            // An unconfirmed lock keeps the card and its answers for a retry; an ended batch or a refusal is stale.
+            throw new HttpFailure(result.state === 'unavailable' ? 503 : 409, 'The owning Agent did not accept this answer', { owner_attachment: this.attachment(result) });
+        }
+    }
     async pending(sid, kind) {
-        const target = this.target(sid);
+        const target = await this.target(sid);
         if (!target)
             throw new HttpFailure(404, 'Session not found');
         const result = await this.call(target, { action: 'snapshot' });
-        const pending = this.prompts(result.snapshot, sid);
+        const pending = this.prompts(result.snapshot, sid, this.batch(target));
         const envelope = kind === 'approval' ? pending.approvalPending(sid) : pending.clarifyPending(sid);
         return { pending: envelope.pending ? redactNestedMessageContainers(envelope.pending, this.deps.redactEnabled()) : null, pending_count: envelope.pending_count };
     }
     async respond(sid, kind, id, value) {
-        const target = this.target(sid);
+        const target = await this.target(sid);
         if (!target)
             return false;
         const current = await this.call(target, { action: 'snapshot' });
-        const pending = this.prompts(current.snapshot, sid);
+        const batch = this.batch(target);
+        const pending = this.prompts(current.snapshot, sid, batch);
         if (current.state !== 'attached')
             throw new HttpFailure(403, 'This canonical session is read-only while its owner is unavailable');
+        if (kind === 'clarify' && batch?.remaining.length && batch.request_id === id) {
+            const entry = pending.peekClarify(sid, id);
+            const reply = entry && value !== null ? clarifyReply(entry, value) : null;
+            if (reply === null)
+                throw new HttpFailure(400, 'Answer every question in the pending clarification');
+            await this.lockBatch(target, batch, JSON.parse(reply).answers);
+            return true;
+        }
         const prompt = current.snapshot?.prompts.find((p) => p.kind === kind && p.prompt_id === id);
         if (!prompt)
             throw new HttpFailure(409, 'The owner prompt is stale');
@@ -228,9 +694,30 @@ export class GatewaySessions {
         await this.action(sid, { action: 'interrupt', execution_generation: watch.snapshot.execution_generation });
         return true;
     }
-    watch(target, base, snapshot) {
-        const watch = { stream: `${ownerStreamPrefix(target.home)}${randomUUID()}`, controller: new AbortController(), snapshot };
+    watch(target, base, snapshot, admissionId) {
+        const watch = { stream: `${ownerStreamPrefix(target.home)}${randomUUID()}`, controller: new AbortController(), snapshot, batch: null, restarting: false };
         this.watches.set(target.key, watch);
+        const observation = this.transport(target, base, snapshot);
+        const release = this.lease(observation);
+        let activeAdmission = admissionId ?? runningAdmission(snapshot)?.admission_id ?? snapshot.pending.find((p) => !p.steering)?.admission_id;
+        let receive = null;
+        const buffered = [{ event: 'snapshot', seq: 0, data: { state: 'attached', reason: null, snapshot, receipt: null, replaying: true } }];
+        const completed = observation.completion?.data;
+        if (completed?.authority_epoch === snapshot.authority_epoch && completed.replay_epoch === snapshot.replay_epoch
+            && completed.execution_generation === snapshot.execution_generation && (completed.payload ?? {}).admission_id === activeAdmission)
+            buffered.push(observation.completion);
+        if (!observation.replaying)
+            buffered.push({ event: 'replay_complete', seq: 0, data: {} });
+        const listener = (frame) => {
+            if (receive)
+                receive(frame);
+            else if (buffered.length < 4096)
+                buffered.push(frame);
+            else
+                watch.controller.abort();
+        };
+        observation.listeners.add(listener);
+        watch.controller.signal.addEventListener('abort', () => { observation.listeners.delete(listener); release(); }, { once: true });
         const registry = this.deps.registry;
         const channel = registry.create(watch.stream, target.sid);
         registry.registerActiveRun({ stream_id: watch.stream, session_id: target.sid, phase: 'running', started_at: this.deps.now(), workspace: str(base.workspace), model: str(base.model) || null, provider: null, ephemeral: false, origin: 'user' });
@@ -238,38 +725,95 @@ export class GatewaySessions {
         let terminal = false;
         let streamError = null;
         let closeWriter = null;
-        let activeAdmission = snapshot.pending.find((p) => p.status === 'started')?.admission_id ?? snapshot.pending[0]?.admission_id;
+        const enqueue = (work) => {
+            chain = chain.then(async () => { if (!terminal && !streamError)
+                await work(); })
+                .catch((error) => { streamError = error; watch.controller.abort(); });
+        };
         const worker = async () => {
             // Same persisted IDs can exist in separate homes. Native observation journals must not
             // join the sid-only direct-chat journal; the owner retains the canonical transcript.
             const journalSession = ownerStateId(target.key);
             const writer = await this.deps.journal.writer(journalSession, watch.stream);
             closeWriter = writer;
+            const showReasoning = await this.deps.showReasoning(target.home).catch(() => false);
+            let completion = null;
+            let replaying = true;
+            let liveRunning = false;
+            let usage = {};
+            let reasoning = '';
+            let titles = new ReasoningTitleTracker();
+            const calls = registry.liveToolCalls.get(watch.stream);
             const put = async (event, data) => {
                 const safe = event === 'tool' || event === 'tool_complete' ? publicToolFrame(data, this.deps.redactEnabled()) : redactNestedMessageContainers(data, this.deps.redactEnabled());
+                // Progress is ephemeral, just like direct turns; a reload gets the channel's latest value after journal replay.
+                if (event === 'tool_progress') {
+                    channel.put([event, safe, null, this.deps.redactEnabled()]);
+                    return;
+                }
                 const record = await writer.appendSseEvent(event, safe);
                 channel.put([event, safe, record.event_id]);
             };
+            const clearTools = async () => {
+                for (const call of calls)
+                    if (call.progress)
+                        await put('tool_progress', { id: call.tid, progress: null });
+                calls.length = 0;
+            };
+            const resetProjection = async () => { await clearTools(); liveRunning = false; reasoning = ''; usage = {}; completion = null; titles = new ReasoningTitleTracker(); };
+            const meter = async (data) => {
+                usage = { ...usage, ...ownerUsage(data) };
+                if (['input_tokens', 'output_tokens', 'cache_read_tokens', 'cache_write_tokens'].every((key) => typeof usage[key] === 'number'))
+                    await put('metering', { session_id: target.sid, usage: { ...usage, estimated_cost: usage.estimated_cost ?? null }, tps: usage.tps ?? null, tps_available: usage.tps !== undefined, estimated: false });
+            };
             const finish = async () => {
-                if (terminal)
+                // A model pick resolves at the owner's next claim boundary, after the turn becomes idle.
+                if (terminal || replaying || this.modelMutations.has(target.key) || this.currentModelChange(target, watch.snapshot)?.state === 'deferred')
                     return;
                 terminal = true;
+                // A new claim may arrive while this turn's receipt is being read. Give it its own projection immediately.
+                if (this.watches.get(target.key) === watch)
+                    this.watches.delete(target.key);
+                registry.activeRuns.delete(watch.stream);
+                await clearTools();
                 const current = await this.call(target, { action: 'snapshot' });
-                const receipt = activeAdmission ? (await this.call(target, { action: 'receipt', admission_id: activeAdmission })).receipt : null;
+                const rawReceipt = activeAdmission ? (await this.call(target, { action: 'receipt', admission_id: activeAdmission })).receipt : null;
+                const receipt = rawReceipt && 'admission_id' in rawReceipt ? rawReceipt : null;
                 const cancelled = receipt?.outcome === 'interrupted' || receipt?.outcome === 'cancelled';
                 const failed = current.state !== 'attached' || receipt?.status !== 'terminal' || receipt.outcome !== 'completed' && !cancelled;
+                const refusal = current.state === 'attached' && current.snapshot && sameExecution(current.snapshot, watch.snapshot)
+                    && receipt?.status === 'terminal' && receipt.outcome === 'failed' && completion && completion.admission === activeAdmission
+                    && receipt.authority_epoch === watch.snapshot.authority_epoch && receipt.execution_generation === watch.snapshot.execution_generation
+                    ? { message: completion.message, type: completion.type, code: completion.code, retryable: completion.retryable } : null;
+                // A terminal frame for the previous generation must not overwrite the newer turn's state.
+                const session = current.snapshot && !sameExecution(current.snapshot, observation.snapshot)
+                    ? undefined : { ...await this.view(base, current, null, target), ...usage };
+                if (session)
+                    session.activity_phase = await this.deps.service.deps.sessionActivity?.(target.sid, target.profile, { terminalPhase: cancelled ? 'cancelled' : failed ? 'failed' : 'completed' });
                 await put(cancelled ? 'cancel' : failed ? 'apperror' : 'done', { session_id: target.sid,
                     terminal_state: cancelled ? 'cancelled' : failed ? 'error' : 'completed',
-                    ...(failed ? { message: 'The owning Agent could not complete this turn', type: current.reason ?? 'owner_turn_failed' } : {}),
-                    session: await this.view(base, current, null, target) });
+                    ...(failed ? refusal ?? { message: 'The owning Agent could not complete this turn', type: current.reason ?? 'owner_turn_failed' } : {}),
+                    ...(Object.keys(usage).length ? { usage } : {}),
+                    ...(session ? { session } : {}) });
+                if (liveRunning && !cancelled && !failed && receipt?.admission_id === activeAdmission && receipt?.authority_epoch === watch.snapshot.authority_epoch
+                    && receipt.execution_generation === watch.snapshot.execution_generation) {
+                    this.deps.onWebCompletion?.(target.profile, target.sid, JSON.stringify(['owner', target.sid, watch.snapshot.authority_epoch, watch.snapshot.replay_epoch, watch.snapshot.execution_generation, receipt.admission_id]));
+                }
                 await put('stream_end', { session_id: target.sid });
                 watch.controller.abort();
             };
-            let pending = this.prompts(snapshot, target.sid);
+            // Reconcile after the last in-flight mutation releases its fence, in the same order as owner frames.
+            watch.reconcile = () => {
+                enqueue(async () => {
+                    if (!watch.snapshot.running && !watch.snapshot.pending.some((p) => p.status === 'queued' || p.status === 'started'))
+                        await finish();
+                });
+            };
+            let pending = this.prompts(snapshot, target.sid, watch.batch);
             let ran = snapshot.running;
             const prompts = async (snap) => {
                 watch.snapshot = snap;
-                pending = this.prompts(snap, target.sid);
+                pending = this.prompts(snap, target.sid, watch.batch);
                 const approval = pending.approvalPending(target.sid);
                 if (approval.pending)
                     await put('approval', { ...approval.pending, pending_count: approval.pending_count });
@@ -278,67 +822,182 @@ export class GatewaySessions {
                     await put('clarify', clarify);
             };
             await prompts(snapshot);
-            const sidecar = this.deps.sidecar();
-            if (!sidecar)
-                throw new Error('sidecar_unavailable');
             if (watch.controller.signal.aborted)
                 return;
-            const result = await sidecar.call('gateway.session', { profile_home: target.home, session_id: target.sid, action: 'watch' }, {
-                signal: watch.controller.signal, timeoutMs: 0,
-                onStream: (frame) => {
-                    chain = chain.then(async () => {
-                        if (terminal || streamError)
+            receive = (frame) => {
+                enqueue(async () => {
+                    if (frame.event === 'replay_complete') {
+                        replaying = false;
+                        liveRunning ||= watch.snapshot.running;
+                        if (!watch.snapshot.running && !watch.snapshot.pending.some((p) => p.status === 'queued' || p.status === 'started'))
+                            await finish();
+                        return;
+                    }
+                    if (frame.event === 'restarting') {
+                        // The owner entered a restart's after-turn wait after this watch attached: clients stop sending.
+                        watch.restarting = true;
+                        await put('session_snapshot', { session: await this.view(base, { state: 'attached', reason: null, snapshot: watch.snapshot, receipt: null, restarting: true }, watch.stream, target) });
+                        return;
+                    }
+                    if (frame.event === 'clarify_batch') {
+                        const batch = GatewayClarifyBatchSchema.parse(frame.data);
+                        watch.batch = { ...batch, remaining: batch.questions.map((q) => q.qid) };
+                        await prompts(watch.snapshot);
+                        return;
+                    }
+                    if (frame.event === 'snapshot') {
+                        const result = GatewaySessionResultSchema.parse(frame.data);
+                        replaying = frame.data.replaying === true;
+                        if (replaying)
+                            liveRunning = false;
+                        if (!result.snapshot)
                             return;
-                        if (frame.event === 'snapshot') {
-                            const result = GatewaySessionResultSchema.parse(frame.data);
-                            if (!result.snapshot)
-                                return;
-                            await put('session_snapshot', { session: await this.view(base, result, watch.stream, target), replay_gap: result.replay_gap === true });
-                            await prompts(result.snapshot);
-                            if (!result.snapshot.running && !result.snapshot.pending.some((p) => p.status === 'queued' || p.status === 'started'))
-                                await finish();
+                        if (result.replay_gap || !sameExecution(result.snapshot, watch.snapshot))
+                            await resetProjection();
+                        await put('session_snapshot', { session: await this.view(base, result, watch.stream, target), replay_gap: result.replay_gap === true });
+                        await prompts(result.snapshot);
+                        liveRunning ||= !replaying && result.snapshot.running;
+                        if (!result.snapshot.running && !result.snapshot.pending.some((p) => p.status === 'queued' || p.status === 'started'))
+                            await finish();
+                        return;
+                    }
+                    const event = frame.data;
+                    const data = (event.payload ?? {});
+                    const kind = str(event.type);
+                    if (kind === 'notification.show' || kind === 'notification.clear') {
+                        await put('notices', { session_id: target.sid, notices: this.nativeNotices(target, observation.snapshot) });
+                        return;
+                    }
+                    if (kind === 'request.cancel') {
+                        // The owner withdraws a settled, timed-out or interrupted batch from every viewer.
+                        if (!watch.batch || watch.batch.request_id !== data.id)
+                            return;
+                        watch.batch = null;
+                        await prompts(watch.snapshot);
+                        if (!pending.clarifyHeadFrame(target.sid))
+                            await put('clarify', { status: 'resolved', clarify_id: data.id });
+                        return;
+                    }
+                    if (kind === 'session.updated') {
+                        // Idle owner mutations carry no execution stamp. The sidecar scopes their subscription and replay.
+                        if (event.session_id !== target.sid
+                            || event.authority_epoch !== undefined && event.authority_epoch !== watch.snapshot.authority_epoch
+                            || event.execution_generation !== undefined && event.execution_generation !== watch.snapshot.execution_generation)
                             return;
+                        if (data.operation !== 'model')
+                            return;
+                        this.rememberModelChange(target, watch.snapshot, modelChange(data));
+                        const current = await this.call(target, { action: 'snapshot' });
+                        if (current.snapshot)
+                            watch.snapshot = current.snapshot;
+                        await put('session_snapshot', { session: await this.view(base, current, watch.stream, target) });
+                        if (!watch.snapshot.running && !watch.snapshot.pending.some((p) => p.status === 'queued' || p.status === 'started'))
+                            await finish();
+                        return;
+                    }
+                    if (kind === 'session.info') {
+                        if (data.authority_epoch !== watch.snapshot.authority_epoch)
+                            return;
+                        if (Number(data.execution_generation) < watch.snapshot.execution_generation)
+                            return;
+                        const firstClaim = !ran && data.running === true;
+                        if (Number(data.execution_generation) > watch.snapshot.execution_generation)
+                            await resetProjection();
+                        watch.snapshot = { ...watch.snapshot, ...data };
+                        const claimed = runningAdmission(watch.snapshot);
+                        if (firstClaim && claimed)
+                            activeAdmission = claimed.admission_id;
+                        ran ||= data.running === true;
+                        liveRunning ||= !replaying && data.running === true;
+                        if (firstClaim)
+                            await put('session_snapshot', { session: await this.view(base, { state: 'attached', reason: null, snapshot: watch.snapshot, receipt: null, restarting: watch.restarting }, watch.stream, target) });
+                        if (data.running === false && (ran || !watch.snapshot.pending.some((p) => p.status === 'queued' || p.status === 'started')))
+                            await finish();
+                        return;
+                    }
+                    if (event.authority_epoch !== watch.snapshot.authority_epoch || event.execution_generation !== watch.snapshot.execution_generation)
+                        return;
+                    if (kind === 'message.delta') {
+                        const stable = titles.stableSnapshot(reasoning);
+                        if (stable !== null)
+                            await put('reasoning', { text: '', titles: stable });
+                        await put('token', { text: str(data.text || data.delta || data.content) });
+                    }
+                    else if (kind === 'reasoning.delta' && showReasoning) {
+                        reasoning += str(data.text);
+                        await put('reasoning', titles.prepare(reasoningEventPayload(data.text, reasoning)));
+                    }
+                    else if (kind.startsWith('subagent.') && str(data.subagent_id)) {
+                        // Reuse the delegate activity row; each child keeps one identity through progress and completion.
+                        const complete = kind === 'subagent.complete';
+                        const preview = kind === 'subagent.thinking' && !showReasoning ? '' : str(data.summary || data.tool_preview || data.text);
+                        await put(complete ? 'tool_complete' : 'tool', { id: `owner-subagent-${str(data.subagent_id)}`, name: 'subagent_progress',
+                            args: { task: str(data.goal) }, preview: preview || null,
+                            ...(complete ? { is_error: data.status !== 'completed', duration: data.duration_seconds } : {}) });
+                    }
+                    else if (kind === 'session.usage')
+                        await meter(data);
+                    else if (kind === 'message.complete') {
+                        if (event.session_id !== target.sid || event.replay_epoch !== undefined && event.replay_epoch !== watch.snapshot.replay_epoch)
+                            return;
+                        // Only this owner-defined refusal is public; never forward provider diagnostics or private descriptor fields.
+                        const surface = data.error_surface;
+                        if (activeAdmission && data.admission_id === activeAdmission && data.outcome === 'failed' && data.status === 'error'
+                            && surface?.layer === 'gateway' && surface.code === 'cron_session_read_only' && surface.retryable === false
+                            && typeof data.text === 'string' && data.text.trim()) {
+                            completion = { admission: activeAdmission, message: data.text, type: 'cron_session_read_only', code: 'cron_session_read_only', retryable: false };
                         }
-                        const event = frame.data;
-                        const data = (event.payload ?? {});
-                        const kind = str(event.type);
-                        if (kind === 'session.info') {
-                            if (data.authority_epoch !== watch.snapshot.authority_epoch)
+                        if (data.usage && typeof data.usage === 'object')
+                            await meter(data.usage);
+                    }
+                    else if (kind === 'tool.start' || kind === 'tool.progress' || kind === 'tool.complete') {
+                        if (event.session_id !== target.sid || event.replay_epoch !== undefined && event.replay_epoch !== watch.snapshot.replay_epoch)
+                            return;
+                        const id = str(data.tool_id) || str(data.tool_call_id);
+                        const call = calls.findLast((call) => call.tid === id);
+                        if (kind === 'tool.start') {
+                            if (id && call)
                                 return;
-                            if (Number(data.execution_generation) < watch.snapshot.execution_generation)
+                            calls.push({ tid: id, name: data.name || data.tool_name, args: data.args ?? {}, done: false });
+                            await put('tool', { ...data, id, name: data.name || data.tool_name });
+                        }
+                        else if (kind === 'tool.progress') {
+                            if (!id || !call || call.done || !watch.snapshot.running)
                                 return;
-                            const firstClaim = !ran && data.running === true;
-                            watch.snapshot = { ...watch.snapshot, ...data };
-                            const claimed = watch.snapshot.pending.find((p) => p.status === 'started');
-                            if (firstClaim && claimed)
-                                activeAdmission = claimed.admission_id;
-                            ran ||= data.running === true;
-                            if (firstClaim)
-                                await put('session_snapshot', { session: await this.view(base, { state: 'attached', reason: null, snapshot: watch.snapshot, receipt: null }, watch.stream, target) });
-                            if (data.running === false && (ran || !watch.snapshot.pending.some((p) => p.status === 'queued' || p.status === 'started')))
-                                await finish();
-                            return;
+                            call.progress = toolProgress({ ...data, message: typeof data.message === 'string' ? redactString(data.message, this.deps.redactEnabled()) : null });
+                            await put('tool_progress', { id, progress: call.progress });
                         }
-                        if (event.authority_epoch !== watch.snapshot.authority_epoch || event.execution_generation !== watch.snapshot.execution_generation)
-                            return;
-                        if (kind === 'message.delta')
-                            await put('token', { text: str(data.text || data.delta || data.content) });
-                        else if (kind === 'tool.start')
-                            await put('tool', { ...data, id: data.tool_id || data.tool_call_id, name: data.name || data.tool_name });
-                        else if (kind === 'tool.complete')
-                            await put('tool_complete', { ...data, id: data.tool_id || data.tool_call_id, name: data.name || data.tool_name });
-                        else if (kind === 'approval.request' || kind === 'clarify.request')
-                            await prompts({ ...watch.snapshot, prompts: [...watch.snapshot.prompts.filter((p) => p.prompt_id !== data.prompt_id), { ...data, kind: kind.split('.')[0] }] });
-                        else if (kind === 'approval.settled' || kind === 'clarify.settled') {
-                            await prompts({ ...watch.snapshot, prompts: watch.snapshot.prompts.filter((p) => p.prompt_id !== data.prompt_id) });
-                            if (kind === 'approval.settled' && !pending.approvalPending(target.sid).pending)
-                                await put('approval_cleared', { pending_count: 0 });
-                            if (kind === 'clarify.settled' && !pending.clarifyHeadFrame(target.sid))
-                                await put('clarify', { status: 'resolved', clarify_id: data.prompt_id });
+                        else {
+                            if (call?.done)
+                                return;
+                            if (call)
+                                Object.assign(call, { done: true, progress: null });
+                            await put('tool_complete', { ...data, id, name: data.name || data.tool_name, progress: null });
                         }
-                    }).catch((error) => { streamError = error; watch.controller.abort(); });
-                },
-            });
+                    }
+                    else if (kind === 'approval.request' || kind === 'clarify.request')
+                        await prompts({ ...watch.snapshot, prompts: [...watch.snapshot.prompts.filter((p) => p.prompt_id !== data.prompt_id), { ...data, kind: kind.split('.')[0] }] });
+                    else if (kind === 'approval.settled' || kind === 'clarify.settled') {
+                        await prompts({ ...watch.snapshot, prompts: watch.snapshot.prompts.filter((p) => p.prompt_id !== data.prompt_id) });
+                        if (kind === 'approval.settled' && !pending.approvalPending(target.sid).pending)
+                            await put('approval_cleared', { pending_count: 0 });
+                        if (kind === 'clarify.settled' && !pending.clarifyHeadFrame(target.sid))
+                            await put('clarify', { status: 'resolved', clarify_id: data.prompt_id });
+                    }
+                });
+            };
+            for (const frame of buffered.splice(0))
+                receive(frame);
+            const result = await Promise.race([
+                observation.ended,
+                new Promise((resolve) => {
+                    const stopped = () => { resolve({ state: 'attached', reason: null, snapshot: watch.snapshot, receipt: null }); };
+                    if (watch.controller.signal.aborted)
+                        stopped();
+                    else
+                        watch.controller.signal.addEventListener('abort', stopped, { once: true });
+                }),
+            ]);
             await chain;
             if (streamError)
                 throw streamError instanceof Error ? streamError : new Error('Owner stream projection failed');
@@ -348,13 +1007,15 @@ export class GatewaySessions {
                 watch.controller.abort();
             }
         };
-        watch.worker = worker().catch((error) => {
+        const running = worker().catch((error) => {
             // Closing the sidecar after a terminal snapshot is expected; every other exit is observable.
             if (!terminal)
                 channel.put(['apperror', { message: 'The owning Agent connection ended', type: 'owner_unavailable', terminal_state: 'error' }, null]);
             this.deps.log(`[webui] owner observation ended: ${error instanceof Error ? error.name : 'error'}`);
         }).finally(async () => {
             watch.controller.abort();
+            observation.listeners.delete(listener);
+            release();
             try {
                 await closeWriter?.close();
             }
@@ -364,15 +1025,23 @@ export class GatewaySessions {
             if (this.watches.get(target.key) === watch)
                 this.watches.delete(target.key);
             registry.retire(watch.stream);
+            this.changed(target);
             this.deps.events.publish('owner_changed', { profile: target.profile, sessionId: target.sid });
+            this.runWorkers.delete(running);
         });
+        this.runWorkers.add(running);
         return watch;
     }
     async close() {
+        const observations = [...this.observations.values()];
+        for (const observation of observations)
+            observation.controller.abort();
         const watches = [...this.watches.values()];
         for (const watch of watches)
             watch.controller.abort();
-        await Promise.allSettled(watches.flatMap((watch) => watch.worker ? [watch.worker] : []));
+        await Promise.allSettled([...this.runWorkers]);
+        await Promise.allSettled(observations.map((observation) => observation.ended));
+        this.modelChanges.clear();
     }
 }
 //# sourceMappingURL=gateway-sessions.js.map