@orion-agents/orion-code 0.3.2 → 0.3.7

package/dist/web/workbench-controller.js

@@ -12,6 +12,7 @@ const mcp_1 = require("../runtime/mcp");
 const product_bootstrap_1 = require("../runtime/product-bootstrap");
 const canonical_1 = require("../runtime/protocol/canonical");
 const plan_review_1 = require("../runtime/plan-review");
+const thread_event_store_1 = require("../runtime/thread-event-store");
 const thread_session_index_1 = require("../runtime/thread-session-index");
 const thread_session_view_1 = require("../runtime/thread-session-view");
 const tool_detail_repository_1 = require("../runtime/tool-detail-repository");
@@ -26,8 +27,10 @@ const errors_1 = require("./errors");
 const event_hub_1 = require("./event-hub");
 const file_read_service_1 = require("./file-read-service");
 const git_read_model_service_1 = require("./git-read-model-service");
+const workspace_mutation_arbiter_1 = require("./workspace-mutation-arbiter");
 const protocol_1 = require("./protocol");
 const review_service_1 = require("./review-service");
+const session_runtime_registry_1 = require("./session-runtime-registry");
 const terminal_manager_1 = require("./terminal-manager");
 var errors_2 = require("./errors");
 Object.defineProperty(exports, "WebWorkbenchError", { enumerable: true, get: function () { return errors_2.WebWorkbenchError; } });
@@ -35,23 +38,52 @@ const SESSION_VIEW_CACHE_BYTES = 16 * 1024 * 1024;
 const MAX_MUTATION_RESULTS = 4096;
 const MAX_CONTEXT_REFERENCE_BYTES = 64 * 1024;
 const MAX_CONTEXT_MANIFEST_BYTES = 256 * 1024;
-/** Owns the sole runtime/controller pair exposed through the local Web host. */
+const CONTEXT_TRANSITION_MUTATIONS = new Set(['context.activate', 'workspace.activate']);
+/** Owns the Workspace surface plus the bounded Web Session actor registry. */
 class WebWorkbenchController {
     constructor(options) {
+        this.activeOrionRuntimes = new Map();
+        /**
+         * Workspace-scoped shared kernels owned by this Host. Control planes and
+         * Session actors both borrow from this pool, so a Workspace Context switch
+         * never tears down kernels that resident actors still reference. The pool is
+         * released only during Host shutdown.
+         */
+        this.workspaceKernels = new Map();
         this.mutationResults = new Map();
         this.sessionViews = new Map();
         this.sessionViewBytes = 0;
         this.toolDetails = new tool_detail_repository_1.FileToolDetailRepository();
+        this.workspaceMutationOwners = new Map();
+        this.pendingWorkspaceMutationStates = new Map();
         this.contextRevisionValue = (0, crypto_1.randomUUID)();
         this.composerRevisionValue = (0, crypto_1.randomUUID)();
         this.suppressComposerEdges = 0;
         this.suppressContextEdges = 0;
         this.latestStatus = 'Ready';
-        this.sessionTransition = false;
+        this.activeMutationCount = 0;
+        this.contextTransitionReserved = false;
         this.closed = false;
+        /**
+         * Host-observed Web activity counters. Exposed through diagnostics() so E2E
+         * and the diagnostics panel can prove that a pure Session selection issues
+         * no control-plane reinstall (controlPlaneInstalls delta 0) and that
+         * snapshots stay bounded and fast (snapshotTotalMs / snapshotLastMs).
+         */
+        this.sessionActivity = {
+            snapshotRequests: 0,
+            snapshotFailures: 0,
+            snapshotTotalMs: 0,
+            snapshotLastMs: 0,
+            controlPlaneInstalls: 0,
+            controlPlaneShutdowns: 0,
+        };
         this.workspaceWatchers = [];
         this.workspaceValue = canonicalDirectory(options.cwd);
         this.eventHub = options.eventHub ?? new event_hub_1.WebEventHub();
+        this.workspaceMutations = new workspace_mutation_arbiter_1.WorkspaceMutationArbiterV1({
+            onStateChanged: state => this.emitWorkspaceMutationState(state),
+        });
         this.workspaceRegistry = options.workspaceRegistry ?? new workspace_registry_1.WorkspaceRegistryV1();
         this.terminalManager = new terminal_manager_1.TerminalManagerV1({
             resolveWorkspace: workspaceId => this.workspaceRegistry.find(workspaceId)?.canonicalPath,
@@ -69,6 +101,11 @@ class WebWorkbenchController {
             options.createRuntime ??
                 (cwd => (0, product_bootstrap_1.createProductUiRuntime)({
                     cwd,
+                    // Borrow the workspace kernel from the Host-owned pool so the
+                    // control plane shares config/Tool/MCP/Settings services with the
+                    // resident Session actors of the same Workspace.
+                    workspaceRuntimeKernel: this.workspaceKernelFor(cwd),
+                    workspaceMutationCoordinator: this.workspaceMutations,
                     shutdownReason: 'Orion Web Workbench shutdown',
                     onActiveSessionRuntime: (runtime, sessionId, activation) => this.observeThreadRuntime(runtime, sessionId, activation),
                     onSettingsInvalidated: event => {
@@ -82,6 +119,19 @@ class WebWorkbenchController {
                         }, false);
                     },
                 }));
+        this.createSessionRuntime =
+            options.createSessionRuntime ??
+                options.createRuntime ??
+                (cwd => (0, product_bootstrap_1.createProductUiRuntime)({
+                    cwd,
+                    // Session actors must keep the kernel of the Workspace they were
+                    // created for, never the currently active control plane's kernel.
+                    workspaceRuntimeKernel: this.workspaceKernelFor(cwd),
+                    workspaceMutationCoordinator: this.workspaceMutations,
+                    shutdownReason: 'Orion Web Session actor shutdown',
+                    onActiveSessionRuntime: (runtime, sessionId, activation) => this.observeThreadRuntime(runtime, sessionId, activation),
+                }));
+        this.sessionRegistry = this.createSessionRegistry();
     }
     static async create(options) {
         const workbench = new WebWorkbenchController(options);
@@ -187,6 +237,25 @@ class WebWorkbenchController {
             this.assertContextGuard(context);
         return result;
     }
+    /** Archived sessions of a Workspace (v0.3.7), newest archive first. */
+    listArchivedWorkspaceSessions(workspaceId, context) {
+        if (context)
+            this.assertContextGuard(context);
+        const entry = this.workspaceRegistry.find(workspaceId);
+        if (!entry) {
+            throw new errors_1.WebWorkbenchError(404, 'Workspace was not found.', 'workspace_not_found');
+        }
+        try {
+            canonicalDirectory(entry.canonicalPath);
+        }
+        catch {
+            throw new errors_1.WebWorkbenchError(409, 'Workspace is unavailable.', 'workspace_unavailable');
+        }
+        const result = Object.freeze((0, session_storage_1.listArchivedProjectSessions)(entry.canonicalPath).map(protocol_1.projectSessionSummary));
+        if (context)
+            this.assertContextGuard(context);
+        return result;
+    }
     async workspaceProjectSummary(workspaceId, context) {
         if (context)
             this.assertContextGuard(context);
@@ -253,16 +322,30 @@ class WebWorkbenchController {
         return result;
     }
     sessionSnapshot(sessionId, cursor, pageSize = 50, tail = false, context) {
+        const startedAt = Date.now();
+        try {
+            const snapshot = this.snapshotSessionV1(sessionId, cursor, pageSize, tail, context);
+            this.recordSessionSnapshotActivity(startedAt);
+            return snapshot;
+        }
+        catch (error) {
+            this.recordSessionSnapshotActivity(startedAt, true);
+            throw error;
+        }
+    }
+    snapshotSessionV1(sessionId, cursor, pageSize = 50, tail = false, context) {
         if (context)
             this.assertContextGuard(context);
         const session = requireSession(sessionId);
         if (canonicalDirectory(session.projectPath) !== this.workspaceValue) {
             throw new errors_1.WebWorkbenchError(409, 'Session belongs to another workspace.');
         }
-        const active = this.runtimeValue.getSession()?.id === session.id;
-        const activeProjection = this.activeOrionRuntime?.sessionId === session.id
-            ? this.activeOrionRuntime.runtime.thread.getProjection()
-            : undefined;
+        const key = this.sessionActorKey(session);
+        const resident = this.sessionRegistry.residentActor(key);
+        const actor = resident?.actor;
+        const baseSessionRuntime = resident?.runtime ?? this.sessionRegistry.summary(key);
+        const active = actor !== undefined;
+        const activeProjection = this.activeOrionRuntimes.get(session.id)?.thread.getProjection();
         let indexedPage;
         if (tail) {
             try {
@@ -352,13 +435,26 @@ class WebWorkbenchController {
                     : [];
         const commits = commitProjections.map(commit => (0, turn_commit_1.parseTurnCommitV1)(commit.receipt));
         const latestCommit = commits.at(-1);
+        const latestProjectedTurn = activeProjection
+            ? Object.values(activeProjection.turns)
+                .sort((left, right) => left.startedSeq - right.startedSeq)
+                .at(-1)
+            : undefined;
+        const durableTerminal = latestProjectedTurn?.status ?? indexedPage?.latestTurn?.status ?? latestCommit?.terminal;
+        const recoverableTerminalPhase = durableTerminal === 'interrupted' || durableTerminal === 'failed'
+            ? durableTerminal
+            : undefined;
+        const sessionRuntime = recoverableTerminalPhase &&
+            ['cold', 'idle', 'interrupted', 'failed'].includes(baseSessionRuntime.phase)
+            ? Object.freeze({ ...baseSessionRuntime, phase: recoverableTerminalPhase })
+            : baseSessionRuntime;
         const planCommit = [...commits].reverse().find(commit => commit.planReceipt);
         const plan = planCommit?.planReceipt
             ? pickPlanReceipt((0, turn_commit_1.parsePlanReceiptV1)(planCommit.planReceipt))
             : null;
-        const state = this.runtimeValue.store.getSnapshot();
+        const state = (actor?.runtime ?? this.runtimeValue).store.getSnapshot();
         const pendingPermissions = active
-            ? this.controllerValue.getPendingPermissions().map(request => ({
+            ? actor.controller.getPendingPermissions().map(request => ({
                 id: request.id,
                 toolName: request.name,
                 ...(request.reason ? { reason: request.reason } : {}),
@@ -374,9 +470,16 @@ class WebWorkbenchController {
                 state: JSON.parse(latestCommit.goalState),
             }
             : null;
+        const projectedComposer = actor
+            ? this.projectActorComposerState(actor, session)
+            : this.projectComposerStateValue(session, undefined, indexedPage?.planReview);
+        const composer = projectedComposer.sessionRuntime.phase === sessionRuntime.phase
+            ? projectedComposer
+            : Object.freeze({ ...projectedComposer, sessionRuntime });
         const snapshot = Object.freeze({
             apiVersion: protocol_1.WEB_API_VERSION,
             session: (0, protocol_1.projectSessionSummary)(session),
+            sessionRuntime,
             threadId: activeProjection?.threadId ?? indexedPage?.threadId ?? view?.threadId ?? null,
             threadCursor: activeProjection?.cursor ?? indexedPage?.cursor ?? view?.cursor ?? 0,
             eventCursor: this.eventHub.snapshot().latest,
@@ -393,8 +496,8 @@ class WebWorkbenchController {
                 processing: active ? state.isProcessing : false,
                 agentMode: state.agentMode,
                 permissionMode: state.permissionMode,
-                status: this.latestStatus,
-                followups: active ? Object.freeze([...this.controllerValue.getFollowupQueue()]) : [],
+                status: actor?.latestStatus ?? 'Ready',
+                followups: active ? Object.freeze([...actor.controller.getFollowupQueue()]) : [],
                 followupLimit: 16,
                 contextUsage: active ? state.contextUsage : null,
                 tokenUsage: active ? state.tokenUsage : null,
@@ -402,71 +505,100 @@ class WebWorkbenchController {
             pendingApprovals: Object.freeze(pendingPermissions),
             goal,
             plan,
-            composer: this.projectComposerState(session, active),
+            composer,
             recoveryDiagnostics: indexedPage ? [] : (view?.diagnostics ?? []),
         });
         if (context)
             this.assertContextGuard(context);
         return snapshot;
     }
+    recordSessionSnapshotActivity(startedAt, failed = false) {
+        const elapsedMs = Date.now() - startedAt;
+        this.sessionActivity.snapshotRequests += 1;
+        if (failed)
+            this.sessionActivity.snapshotFailures += 1;
+        this.sessionActivity.snapshotTotalMs += elapsedMs;
+        this.sessionActivity.snapshotLastMs = elapsedMs;
+    }
     composerState(sessionId, context) {
         if (context)
             this.assertContextGuard(context);
-        this.assertCommandSession(sessionId);
         const session = requireSession(sessionId);
-        const state = this.projectComposerState(session, true);
+        this.assertSessionWorkspace(session);
+        const actor = this.sessionRegistry.residentActor(this.sessionActorKey(session))?.actor;
+        const state = actor
+            ? this.projectActorComposerState(actor, session)
+            : this.projectComposerStateValue(session);
         if (context)
             this.assertContextGuard(context);
         return state;
     }
-    projectComposerState(session, active) {
-        const state = this.projectComposerStateValue(session, active);
-        if (!active)
-            return state;
+    sessionRuntimeSummary(sessionId) {
+        const session = requireSession(sessionId);
+        this.assertSessionWorkspace(session);
+        return this.sessionRegistry.summary(this.sessionActorKey(session));
+    }
+    async waitForSessionIdle(sessionId) {
+        const session = requireSession(sessionId);
+        this.assertSessionWorkspace(session);
+        const actor = this.sessionRegistry.residentActor(this.sessionActorKey(session))?.actor;
+        await actor?.controller.waitForIdle();
+    }
+    projectActorComposerState(actor, session) {
+        const state = this.projectComposerStateValue(session, actor);
         // Durable Thread and Store authority can advance before the debounced SSE
         // observer runs. Keep every projected control state and its CAS token in
         // the same synchronous boundary so the UI never receives new controls
         // paired with an older revision.
         const authorityDigest = composerAuthorityDigest(state);
-        if (this.composerAuthorityDigest === undefined) {
-            this.composerAuthorityDigest = authorityDigest;
+        if (actor.composerAuthorityDigest === undefined) {
+            actor.composerAuthorityDigest = authorityDigest;
             return state;
         }
-        if (authorityDigest === this.composerAuthorityDigest)
+        if (authorityDigest === actor.composerAuthorityDigest)
             return state;
-        this.bumpComposerRevision();
-        this.composerAuthorityDigest = authorityDigest;
-        return Object.freeze({ ...state, controlRevision: this.composerRevisionValue });
-    }
-    projectComposerStateValue(session, active) {
-        const controls = this.runtimeValue.sessionComposerControls;
+        actor.composerRevision = (0, crypto_1.randomUUID)();
+        actor.composerAuthorityDigest = authorityDigest;
+        return Object.freeze({ ...state, controlRevision: actor.composerRevision });
+    }
+    projectComposerStateValue(session, actor, indexedPlanReview) {
+        const runtimeOwner = actor?.runtime ?? this.runtimeValue;
+        const controller = actor?.controller;
+        const controls = runtimeOwner.sessionComposerControls;
         if (!controls) {
             throw new errors_1.WebWorkbenchError(503, 'Session Composer controls are unavailable.', 'composer_controls_unavailable');
         }
         const runtime = controls.describeSession(session);
-        const queue = active
-            ? this.controllerValue.getFollowupQueueSnapshot()
+        const queue = actor
+            ? actor.controller.getFollowupQueueSnapshot()
             : { items: [], limit: 16 };
-        const projection = active && this.activeOrionRuntime?.sessionId === session.id
-            ? this.activeOrionRuntime.runtime.thread.getProjection()
+        const projection = actor
+            ? this.activeOrionRuntimes.get(session.id)?.thread.getProjection()
             : undefined;
-        const review = projection?.planReview;
-        const workspace = this.activeWorkspaceEntry();
+        const review = projection?.planReview ?? indexedPlanReview;
+        const workspaceId = this.workspaceRegistry
+            .list()
+            .find(entry => entry.canonicalPath === canonicalDirectory(session.projectPath))?.id;
+        if (!workspaceId) {
+            throw new errors_1.WebWorkbenchError(404, 'Workspace was not found.', 'workspace_not_found');
+        }
+        const sessionRuntime = this.sessionRegistry.summary({ workspaceId, sessionId: session.id });
         return Object.freeze({
             apiVersion: protocol_1.WEB_API_VERSION,
-            workspaceId: workspace.id,
+            workspaceId,
             sessionId: session.id,
             contextRevision: this.contextRevisionValue,
-            controlRevision: this.composerRevisionValue,
-            processing: active &&
-                (this.runtimeValue.store.getSnapshot().isProcessing || Boolean(projection?.activeTurnId)),
-            mode: active
-                ? Object.freeze({ ...this.controllerValue.getAgentModeSnapshot() })
+            controlRevision: actor?.composerRevision ?? sessionRuntime.runtimeRevision,
+            sessionRuntime,
+            processing: Boolean(actor) &&
+                (runtimeOwner.store.getSnapshot().isProcessing || Boolean(projection?.activeTurnId)),
+            mode: controller
+                ? Object.freeze({ ...controller.getAgentModeSnapshot() })
                 : Object.freeze({ baseMode: 'interactive', pendingBaseMode: null }),
             model: runtime.model,
             permission: runtime.permission,
             contextUsage: runtime.contextUsage,
-            compactAvailable: active && this.controllerValue.canCompactContext(),
+            compactAvailable: controller?.canCompactContext() ?? false,
             pending: runtime.pending,
             lastError: runtime.lastError,
             planReview: review
@@ -489,8 +621,10 @@ class WebWorkbenchController {
     modelCatalog(sessionId, context) {
         if (context)
             this.assertContextGuard(context);
-        this.assertCommandSession(sessionId);
-        const controls = this.runtimeValue.sessionComposerControls;
+        const session = requireSession(sessionId);
+        this.assertSessionWorkspace(session);
+        const actor = this.sessionRegistry.residentActor(this.sessionActorKey(session))?.actor;
+        const controls = (actor?.runtime ?? this.runtimeValue).sessionComposerControls;
         if (!controls) {
             throw new errors_1.WebWorkbenchError(503, 'Session model catalog is unavailable.', 'composer_controls_unavailable');
         }
@@ -501,12 +635,29 @@ class WebWorkbenchController {
     }
     async applyComposerAction(input) {
         this.assertContextGuard(input);
-        this.assertCommandSession(input.expectedSessionId);
-        const admittedState = this.composerState(input.expectedSessionId);
+        const session = requireSession(input.expectedSessionId);
+        this.assertSessionWorkspace(session);
+        const key = this.sessionActorKey(session);
+        const wasResident = this.sessionRegistry.summary(key).resident;
+        let actor;
+        try {
+            actor = (await this.sessionRegistry.ensureResident(key, input.expectedSessionRuntimeRevision))
+                .actor;
+        }
+        catch (error) {
+            throw mapSessionRuntimeError(error);
+        }
+        const actorSession = actor.runtime.getSession();
+        if (!actorSession || actorSession.id !== input.expectedSessionId) {
+            throw new errors_1.WebWorkbenchError(503, 'Session actor is not bound to the expected Session.', 'session_unavailable');
+        }
+        if (!wasResident)
+            actor.composerRevision = input.expectedControlRevision;
+        const admittedState = this.projectActorComposerState(actor, actorSession);
         if (input.expectedControlRevision !== admittedState.controlRevision) {
             throw new errors_1.WebWorkbenchError(409, 'Composer controls changed before the action was admitted.', 'composer_control_conflict');
         }
-        const controls = this.runtimeValue.sessionComposerControls;
+        const controls = actor.runtime.sessionComposerControls;
         if (!controls) {
             throw new errors_1.WebWorkbenchError(503, 'Session Composer controls are unavailable.', 'composer_controls_unavailable');
         }
@@ -515,11 +666,11 @@ class WebWorkbenchController {
         let modelReceipt;
         let permissionReceipt;
         let planReviewReceipt;
-        this.suppressComposerEdges += 1;
+        actor.suppressComposerEdges += 1;
         try {
             switch (input.type) {
                 case 'set_agent_mode': {
-                    const result = this.controllerValue.setAgentMode(input.mode);
+                    const result = actor.controller.setAgentMode(input.mode);
                     outcome =
                         result.type === 'agent_mode_changed' && result.appliesFrom === 'next-logical-request'
                             ? 'deferred'
@@ -543,7 +694,7 @@ class WebWorkbenchController {
                     outcome = modelReceipt.appliesFrom === 'next-logical-request' ? 'deferred' : 'applied';
                     break;
                 case 'compact_context': {
-                    const result = await this.controllerValue.compactContext();
+                    const result = await actor.controller.compactContext();
                     if (result.status === 'rejected') {
                         throw new errors_1.WebWorkbenchError(409, 'Context compact was rejected.', 'runtime_busy');
                     }
@@ -551,24 +702,24 @@ class WebWorkbenchController {
                     break;
                 }
                 case 'edit_queue_item':
-                    detail = JSON.stringify(this.controllerValue.editFollowupQueueItem(input.itemId, input.expectedItemRevision, input.text));
+                    detail = JSON.stringify(actor.controller.editFollowupQueueItem(input.itemId, input.expectedItemRevision, input.text));
                     break;
                 case 'move_queue_item':
-                    detail = JSON.stringify(this.controllerValue.moveFollowupQueueItem(input.itemId, input.expectedItemRevision, input.targetIndex));
+                    detail = JSON.stringify(actor.controller.moveFollowupQueueItem(input.itemId, input.expectedItemRevision, input.targetIndex));
                     break;
                 case 'remove_queue_item':
-                    detail = JSON.stringify(this.controllerValue.removeFollowupQueueItem(input.itemId, input.expectedItemRevision));
+                    detail = JSON.stringify(actor.controller.removeFollowupQueueItem(input.itemId, input.expectedItemRevision));
                     break;
                 case 'review_plan': {
-                    planReviewReceipt = await this.controllerValue.reviewPlan({
+                    planReviewReceipt = await actor.controller.reviewPlan({
                         planDigest: input.planDigest,
                         action: input.action,
                         ...(input.feedback ? { feedback: input.feedback } : {}),
                     });
                     if (input.action === 'approve')
-                        this.controllerValue.setAgentMode('interactive');
+                        actor.controller.setAgentMode('interactive');
                     else if (input.action === 'continue')
-                        this.controllerValue.setAgentMode('plan');
+                        actor.controller.setAgentMode('plan');
                     detail = JSON.stringify(planReviewReceipt.admission);
                     break;
                 }
@@ -578,18 +729,18 @@ class WebWorkbenchController {
             throw mapComposerControlError(error);
         }
         finally {
-            this.suppressComposerEdges -= 1;
+            actor.suppressComposerEdges -= 1;
         }
-        this.bumpComposerRevision();
-        const state = this.projectComposerStateValue(requireSession(input.expectedSessionId), true);
-        this.composerAuthorityDigest = composerAuthorityDigest(state);
+        actor.composerRevision = (0, crypto_1.randomUUID)();
+        const state = this.projectComposerStateValue(actorSession, actor);
+        actor.composerAuthorityDigest = composerAuthorityDigest(state);
         this.eventHub.emit({ type: 'composer_state_changed', state }, true, {
             sessionId: input.expectedSessionId,
         });
         return Object.freeze({
             requestId: input.requestId,
             outcome,
-            controlRevision: this.composerRevisionValue,
+            controlRevision: actor.composerRevision,
             state,
             ...(modelReceipt ? { modelReceipt } : {}),
             ...(permissionReceipt ? { permissionReceipt } : {}),
@@ -727,56 +878,28 @@ class WebWorkbenchController {
         return result;
     }
     async createSession(name, context) {
-        this.assertReadyForTransition('create a session');
         if (context)
             this.assertContextGuard(context);
-        this.sessionTransition = true;
-        try {
-            // A new Session inherits the durable default; an override on the currently
-            // active Session must never leak into the next Session.
-            const session = (0, session_storage_1.createSession)(this.workspaceValue, this.settings().sections.defaults.model.effectiveValue);
-            (0, global_config_1.incrementSessionCount)();
-            const named = name?.trim() ? ((0, session_storage_1.renameSession)(session.id, name.trim()) ?? session) : session;
-            this.runtimeValue.setSession(named);
-            await this.runtimeValue.rebindSessionRuntime?.();
-            this.eventHub.emitRuntime({ type: 'transcript_clear' });
-            this.emitState();
-            return (0, protocol_1.projectSessionSummary)(named);
-        }
-        finally {
-            this.sessionTransition = false;
-        }
+        // A new Session inherits the durable default; an override on another
+        // Session actor must never leak into it. Creation does not activate or
+        // close any actor; foreground selection belongs to the browser tab.
+        const session = (0, session_storage_1.createSession)(this.workspaceValue, this.settings().sections.defaults.model.effectiveValue);
+        (0, global_config_1.incrementSessionCount)();
+        const named = name?.trim() ? ((0, session_storage_1.renameSession)(session.id, name.trim()) ?? session) : session;
+        this.sessionRegistry.summary(this.sessionActorKey(named));
+        return (0, protocol_1.projectSessionSummary)(named);
     }
     async activateSession(sessionId, context) {
-        this.assertReadyForTransition('switch sessions');
         if (context)
             this.assertContextGuard(context);
-        this.sessionTransition = true;
-        this.suppressContextEdges += 1;
-        let activated = false;
-        try {
-            const session = requireSession(sessionId);
-            if (canonicalDirectory(session.projectPath) !== this.workspaceValue) {
-                throw new errors_1.WebWorkbenchError(409, 'Session belongs to another workspace.');
-            }
-            const result = this.controllerValue.handle({
-                type: 'select_session',
-                sessionId: session.id,
-                source: 'programmatic',
-            });
-            await this.controllerValue.waitForIdle();
-            if (this.runtimeValue.getSession()?.id !== session.id) {
-                throw new errors_1.WebWorkbenchError(409, 'Session activation was rejected by the runtime.');
-            }
-            activated = true;
-            return { requestId: `activate:${session.id}`, result: result.type };
-        }
-        finally {
-            this.suppressContextEdges -= 1;
-            this.sessionTransition = false;
-            if (activated)
-                this.emitState();
-        }
+        const session = requireSession(sessionId);
+        this.assertSessionWorkspace(session);
+        const sessionRuntime = this.sessionRegistry.summary(this.sessionActorKey(session));
+        return {
+            requestId: `activate:${session.id}`,
+            result: 'foreground_session_selected',
+            sessionRuntime,
+        };
     }
     renameSession(sessionId, name, context) {
         if (context)
@@ -785,13 +908,94 @@ class WebWorkbenchController {
         if (canonicalDirectory(session.projectPath) !== this.workspaceValue) {
             throw new errors_1.WebWorkbenchError(409, 'Session belongs to another workspace.');
         }
-        if (name.length > 120)
+        const normalizedName = name.trim();
+        if (!normalizedName)
+            throw new errors_1.WebWorkbenchError(400, 'Session name is required.');
+        if (normalizedName.length > 120)
             throw new errors_1.WebWorkbenchError(400, 'Session name is too long.');
-        const updated = (0, session_storage_1.renameSession)(session.id, name);
+        const updated = (0, session_storage_1.renameSession)(session.id, normalizedName);
+        if (!updated)
+            throw new errors_1.WebWorkbenchError(404, 'Session no longer exists.');
+        return (0, protocol_1.projectSessionSummary)(updated);
+    }
+    setSessionTags(sessionId, tags, context) {
+        if (context)
+            this.assertContextGuard(context);
+        const session = requireSession(sessionId);
+        this.assertSessionWorkspace(session);
+        if (!Array.isArray(tags)) {
+            throw new errors_1.WebWorkbenchError(400, 'Tags must be an array of strings.', 'invalid_tags');
+        }
+        if (tags.length > session_storage_1.SESSION_TAG_LIMIT) {
+            throw new errors_1.WebWorkbenchError(400, `A session can have at most ${session_storage_1.SESSION_TAG_LIMIT} tags.`, 'invalid_tags');
+        }
+        for (const raw of tags) {
+            if (typeof raw !== 'string' || !raw.trim()) {
+                throw new errors_1.WebWorkbenchError(400, 'Every tag must be a non-empty string.', 'invalid_tags');
+            }
+            if (raw.trim().length > session_storage_1.SESSION_TAG_MAX_LENGTH) {
+                throw new errors_1.WebWorkbenchError(400, `Each tag is limited to ${session_storage_1.SESSION_TAG_MAX_LENGTH} characters.`, 'invalid_tags');
+            }
+        }
+        const updated = (0, session_storage_1.setSessionTags)(session.id, (0, session_storage_1.normalizeSessionTags)(tags));
         if (!updated)
             throw new errors_1.WebWorkbenchError(404, 'Session no longer exists.');
         return (0, protocol_1.projectSessionSummary)(updated);
     }
+    archiveSession(sessionId, context) {
+        if (context)
+            this.assertContextGuard(context);
+        const session = requireSession(sessionId);
+        this.assertSessionWorkspace(session);
+        this.assertSessionNotBusy(session);
+        const updated = (0, session_storage_1.archiveSession)(session.id);
+        if (!updated)
+            throw new errors_1.WebWorkbenchError(404, 'Session no longer exists.');
+        return (0, protocol_1.projectSessionSummary)(updated);
+    }
+    restoreSession(sessionId, context) {
+        if (context)
+            this.assertContextGuard(context);
+        const session = requireSession(sessionId);
+        this.assertSessionWorkspace(session);
+        const updated = (0, session_storage_1.restoreSession)(session.id);
+        if (!updated)
+            throw new errors_1.WebWorkbenchError(404, 'Session no longer exists.');
+        return (0, protocol_1.projectSessionSummary)(updated);
+    }
+    deleteSession(sessionId, context) {
+        if (context)
+            this.assertContextGuard(context);
+        const session = requireSession(sessionId);
+        this.assertSessionWorkspace(session);
+        this.assertSessionHasNoActor(session);
+        const removed = (0, session_storage_1.deleteSession)(session.id);
+        if (!removed) {
+            throw new errors_1.WebWorkbenchError(409, 'Session files could not be fully removed; nothing was deleted.', 'session_delete_failed');
+        }
+        return { deleted: true };
+    }
+    /**
+     * A busy Session (starting / queued / running / waiting approval / stopping)
+     * must not be archived or deleted while its actor is doing work.
+     */
+    assertSessionNotBusy(session) {
+        const runtime = this.sessionRegistry.summary(this.sessionActorKey(session));
+        const busy = new Set(['starting', 'queued', 'running', 'waiting_approval', 'stopping']);
+        if (busy.has(runtime.phase)) {
+            throw new errors_1.WebWorkbenchError(409, 'Session is busy; stop it before archiving or deleting.', 'session_busy');
+        }
+    }
+    /**
+     * Deletion removes files under the Session while a resident actor may still
+     * hold them open — require that no actor exists at all (phase 'cold').
+     */
+    assertSessionHasNoActor(session) {
+        const resident = this.sessionRegistry.residentActor(this.sessionActorKey(session));
+        if (resident) {
+            throw new errors_1.WebWorkbenchError(409, 'Session has an active runtime; stop it before deleting.', 'session_busy');
+        }
+    }
     async switchWorkspace(path, context) {
         this.assertContextGuard(context);
         const next = canonicalDirectory(path);
@@ -823,10 +1027,13 @@ class WebWorkbenchController {
             throw new errors_1.WebWorkbenchError(409, 'Session does not belong to the requested Workspace.', 'context_session_mismatch');
         }
         const currentSessionId = this.runtimeValue.getSession()?.id ?? null;
-        if (targetWorkspace === this.workspaceValue && targetSession?.id === currentSessionId)
-            return;
-        if (targetWorkspace === this.workspaceValue && !targetSession && currentSessionId === null)
+        if (targetWorkspace === this.workspaceValue) {
+            if (targetSession)
+                this.sessionRegistry.summary(this.sessionActorKey(targetSession));
+            // Session foreground selection is browser-local. A same-Workspace
+            // selection never mutates the Host Context or any Session actor.
             return;
+        }
         this.assertReadyForTransition('activate a Context');
         const previousWorkspace = this.workspaceValue;
         const previousSessionId = currentSessionId;
@@ -838,17 +1045,28 @@ class WebWorkbenchController {
                 await previousController.stopActiveTurn();
                 await previousController.waitForIdle();
                 if (targetWorkspace !== previousWorkspace) {
-                    await previousRuntime.shutdown();
+                    // Detach the control-plane foreground first: releasing the previous
+                    // control plane must not end a Session that a resident actor of that
+                    // Workspace is still driving.
+                    await this.restoreContextSession(null);
+                    // P1-A runtime ownership: the Host-level Session registry and its
+                    // resident actors are preserved across a Workspace Context switch.
+                    // Only the active control plane is swapped. Both control planes
+                    // borrowed their Workspace kernel from the shared pool, so releasing
+                    // the previous one never tears down kernels that running Session
+                    // actors of that Workspace still reference. Install the target
+                    // control plane first, then release the previous one's mutable state.
                     await this.installRuntime(targetWorkspace, false);
+                    await previousRuntime.shutdown();
                 }
-                await this.restoreContextSession(targetSession?.id ?? null);
                 this.workspaceRegistry.register(targetWorkspace, { activated: true });
             }
             catch (activationError) {
                 try {
-                    if (targetWorkspace !== previousWorkspace) {
-                        if (this.runtimeValue !== previousRuntime)
-                            await this.runtimeValue.shutdown();
+                    if (this.runtimeValue !== previousRuntime) {
+                        // The target control plane installed but a later step failed; tear
+                        // it down and reinstall the previous Workspace's control plane.
+                        await this.runtimeValue.shutdown();
                         await this.installRuntime(previousWorkspace, false);
                     }
                     await this.restoreContextSession(previousSessionId);
@@ -875,9 +1093,24 @@ class WebWorkbenchController {
     dispatch(raw) {
         const command = (0, protocol_1.parseWebCommand)(raw);
         return this.executeMutation(command.requestId, 'command', command, async () => {
-            this.assertCommandSession(command.expectedSessionId);
+            this.assertContextGuard(command);
+            const session = requireSession(command.expectedSessionId);
+            this.assertSessionWorkspace(session);
+            const key = this.sessionActorKey(session);
+            if (command.type === 'cancel_queued_turn') {
+                try {
+                    const sessionRuntime = this.sessionRegistry.cancelQueued(key, command.queueId, command.expectedSessionRuntimeRevision);
+                    return Object.freeze({
+                        requestId: command.requestId,
+                        result: 'session_turn_queue_cancelled',
+                        sessionRuntime,
+                    });
+                }
+                catch (error) {
+                    throw mapSessionRuntimeError(error);
+                }
+            }
             const resolved = await this.resolveCommandContext(command);
-            this.assertCommandSession(command.expectedSessionId);
             const runtimeInput = resolved && command.type === 'queue_followup'
                 ? {
                     type: 'queue_followup',
@@ -886,13 +1119,71 @@ class WebWorkbenchController {
                     source: 'programmatic',
                 }
                 : (0, protocol_1.toAgentRuntimeInput)({ ...command, ...(resolved ? { text: resolved.text } : {}) });
-            const runtimeResult = this.controllerValue.handle(runtimeInput);
-            return Object.freeze({
-                requestId: command.requestId,
-                result: runtimeResult.type,
-                detail: JSON.stringify(runtimeResult),
-                ...(resolved ? { contextReceipt: resolved.receipt } : {}),
-            });
+            try {
+                if (command.type === 'submit') {
+                    const currentRuntime = this.sessionRegistry.summary(key);
+                    if (['running', 'waiting_approval'].includes(currentRuntime.phase)) {
+                        const routed = await this.sessionRegistry.withActor(key, command.expectedSessionRuntimeRevision, actor => {
+                            if (!actor.controller.hasActiveTurn()) {
+                                throw new session_runtime_registry_1.WebSessionRuntimeRegistryError(409, 'session_runtime_revision_conflict', 'The Session turn ended before steering was admitted.');
+                            }
+                            return actor.controller.handle(runtimeInput);
+                        });
+                        return Object.freeze({
+                            requestId: command.requestId,
+                            result: routed.result.type,
+                            detail: JSON.stringify(routed.result),
+                            sessionRuntime: routed.runtime,
+                            ...(resolved ? { contextReceipt: resolved.receipt } : {}),
+                        });
+                    }
+                    const admission = await this.sessionRegistry.admitTurn({
+                        key,
+                        expectedRuntimeRevision: command.expectedSessionRuntimeRevision,
+                        start: async (actor) => {
+                            const runtimeResult = actor.controller.handle(runtimeInput);
+                            return {
+                                accepted: runtimeResult,
+                                settled: actor.controller.waitForIdle(),
+                            };
+                        },
+                    });
+                    if (admission.status === 'queued') {
+                        return Object.freeze({
+                            requestId: command.requestId,
+                            result: 'session_turn_queued',
+                            queueId: admission.queueId,
+                            queuePosition: admission.queuePosition,
+                            sessionRuntime: admission.runtime,
+                            ...(resolved ? { contextReceipt: resolved.receipt } : {}),
+                        });
+                    }
+                    return Object.freeze({
+                        requestId: command.requestId,
+                        result: admission.accepted.type,
+                        detail: JSON.stringify(admission.accepted),
+                        sessionRuntime: admission.runtime,
+                        ...(resolved ? { contextReceipt: resolved.receipt } : {}),
+                    });
+                }
+                const routed = await this.sessionRegistry.withActor(key, command.expectedSessionRuntimeRevision, actor => {
+                    const runtimeResult = actor.controller.handle(runtimeInput);
+                    if (command.type === 'permission_decision') {
+                        this.sessionRegistry.setPendingApprovalCount(key, actor.controller.getPendingPermissions().length);
+                    }
+                    return runtimeResult;
+                });
+                return Object.freeze({
+                    requestId: command.requestId,
+                    result: routed.result.type,
+                    detail: JSON.stringify(routed.result),
+                    sessionRuntime: routed.runtime,
+                    ...(resolved ? { contextReceipt: resolved.receipt } : {}),
+                });
+            }
+            catch (error) {
+                throw mapSessionRuntimeError(error);
+            }
         });
     }
     async resolveCommandContext(command) {
@@ -1048,6 +1339,7 @@ class WebWorkbenchController {
         return (0, redaction_1.redactTraceText)(value).split(this.workspaceValue).join('<workspace>');
     }
     async updateSettings(input) {
+        this.assertContextGuard(input);
         this.assertSettingsAvailable();
         const update = this.runtimeValue.updateSettings;
         if (!update) {
@@ -1098,10 +1390,23 @@ class WebWorkbenchController {
         if (this.mutationResults.size >= MAX_MUTATION_RESULTS) {
             throw new errors_1.WebWorkbenchError(503, 'The mutation idempotency ledger is full; restart the local Web Host before retrying.', 'mutation_capacity_exhausted');
         }
-        const result = Promise.resolve().then(() => {
-            this.assertMutationAdmission();
-            return action();
-        });
+        const contextTransition = CONTEXT_TRANSITION_MUTATIONS.has(operation);
+        let result;
+        try {
+            this.reserveMutation(contextTransition);
+            result = Promise.resolve()
+                .then(() => {
+                this.assertMutationAdmission();
+                return action();
+            })
+                .finally(() => this.releaseMutation(contextTransition));
+        }
+        catch (error) {
+            // Mutation admission is part of the idempotent result contract. Cache a
+            // rejected Promise just like failures raised by the action so a retry of
+            // the same requestId cannot observe a different outcome.
+            result = Promise.reject(error);
+        }
         this.mutationResults.set(requestId, { fingerprint, result });
         return result;
     }
@@ -1134,9 +1439,18 @@ class WebWorkbenchController {
             mcp: { servers: mcpServerIds(mcp) },
             harness,
             eventStream: this.eventHub.snapshot(),
+            workspaceKernel: this.runtimeValue.workspaceRuntimeKernel?.diagnostics() ?? null,
+            session: {
+                ...this.sessionActivity,
+                actors: this.sessionRegistry.stats(),
+            },
             performance: {
                 files: this.fileService.performanceCounters(),
                 git: this.gitService.performanceCounters(),
+                thread: {
+                    eventStore: (0, thread_event_store_1.threadEventStorePerformanceCountersV1)(),
+                    sessionIndex: (0, thread_session_index_1.threadSessionIndexPerformanceCountersV1)(),
+                },
             },
         };
         if (context)
@@ -1144,18 +1458,273 @@ class WebWorkbenchController {
         return result;
     }
     async shutdown() {
-        if (this.closed)
-            return;
+        if (this.shutdownResult)
+            return this.shutdownResult;
         this.closed = true;
-        await this.controllerValue.stopActiveTurn();
-        await this.controllerValue.waitForIdle();
-        this.closeWorkspaceWatchers();
-        this.closeComposerObserver();
-        await this.terminalManager.shutdown();
-        await this.runtimeValue.shutdown();
-        this.eventHub.close();
+        this.shutdownResult = this.shutdownOwnedResources();
+        return this.shutdownResult;
+    }
+    async shutdownOwnedResources() {
+        const failures = [];
+        this.sessionActivity.controlPlaneShutdowns += 1;
+        this.workspaceMutations.close('Orion Web Workbench shutdown');
+        try {
+            await this.sessionRegistry.shutdown('Orion Web Workbench shutdown');
+        }
+        catch {
+            // The registry retains failed actor handles. Retry once after every
+            // actor received its first close attempt; a persistent failure remains
+            // an explicit Host shutdown error rather than an orphan hidden as GO.
+            try {
+                await this.sessionRegistry.shutdown('Orion Web Workbench shutdown retry');
+            }
+            catch (retryError) {
+                failures.push(retryError);
+            }
+        }
+        await captureShutdownFailure(failures, () => this.controllerValue.stopActiveTurn());
+        await captureShutdownFailure(failures, () => this.controllerValue.waitForIdle());
+        try {
+            this.closeWorkspaceWatchers();
+            this.closeComposerObserver();
+        }
+        catch (error) {
+            failures.push(error);
+        }
+        await captureShutdownFailure(failures, () => this.terminalManager.shutdown());
+        await captureShutdownFailure(failures, () => this.runtimeValue.shutdown());
+        try {
+            this.eventHub.close();
+        }
+        catch (error) {
+            failures.push(error);
+        }
+        this.workspaceMutationOwners.clear();
+        this.pendingWorkspaceMutationStates.clear();
+        this.releaseWorkspaceKernels();
+        if (failures.length > 0) {
+            throw new errors_1.WebWorkbenchError(503, `${failures.length} Web Workbench resource(s) could not be closed safely.`, 'workbench_shutdown_incomplete');
+        }
+    }
+    /**
+     * Return the workspace kernel for `cwd`, creating and pooling one on first
+     * use. Control planes and Session actors borrow the same kernel instance per
+     * canonical Workspace; the pool is released only when the Host shuts down.
+     */
+    workspaceKernelFor(cwd) {
+        const canonical = canonicalDirectory(cwd);
+        const existing = this.workspaceKernels.get(canonical);
+        if (existing && !existing.diagnostics().closed)
+            return existing;
+        if (existing)
+            this.workspaceKernels.delete(canonical);
+        const kernel = (0, product_bootstrap_1.createWorkspaceRuntimeKernelV1)({
+            cwd: canonical,
+            onSettingsInvalidated: event => this.onWorkspaceKernelSettingsInvalidated(canonical, event),
+        });
+        this.workspaceKernels.set(canonical, kernel);
+        return kernel;
+    }
+    /**
+     * Settings invalidations from pooled kernels are only forwarded while their
+     * Workspace is the active Context. A background Workspace's coordinator
+     * keeps watching its own durable file; its next activation publishes a fresh
+     * Settings document through `emitSettingsWorkspaceChange()`.
+     */
+    onWorkspaceKernelSettingsInvalidated(kernelWorkspace, event) {
+        if (this.suppressContextEdges > 0)
+            return;
+        if (kernelWorkspace !== this.workspaceValue)
+            return;
+        this.eventHub.emit({
+            type: 'settings_invalidated',
+            revision: event.revision,
+            reason: event.reason,
+            state: event.state,
+        }, false);
+    }
+    /**
+     * Release the Host owner seat on every pooled kernel. Runtime shutdowns have
+     * already disposed their Settings participants (actors first, then the
+     * active control plane), so an unowned kernel with zero participants closes
+     * its Settings coordinator here. A kernel that still has a running actor
+     * participant survives until that actor actually terminates.
+     */
+    releaseWorkspaceKernels() {
+        for (const kernel of this.workspaceKernels.values()) {
+            kernel.releaseOwner();
+        }
+        this.workspaceKernels.clear();
+    }
+    createSessionRegistry() {
+        return new session_runtime_registry_1.WebSessionRuntimeRegistryV1({
+            maxRunningSessions: 3,
+            maxResidentSessionActors: 4,
+            createActor: key => this.createSessionActor(key),
+            initializeActor: actor => actor.runtime.rebindSessionRuntime?.() ?? Promise.resolve(),
+            closeActor: (actor, reason) => this.closeSessionActor(actor, reason),
+            estimateActorBytes: actor => estimateSessionActorBytes(actor),
+            onSummaryChanged: runtime => {
+                if (this.closed || this.suppressContextEdges > 0)
+                    return;
+                this.eventHub.emit({ type: 'session_runtime_changed', runtime }, true, {
+                    sessionId: runtime.sessionId,
+                });
+            },
+        });
+    }
+    async createSessionActor(key) {
+        const workspace = this.workspaceRegistry.find(key.workspaceId);
+        if (!workspace) {
+            throw new errors_1.WebWorkbenchError(404, 'Workspace was not found.', 'workspace_not_found');
+        }
+        const session = requireSession(key.sessionId);
+        if (canonicalDirectory(session.projectPath) !== workspace.canonicalPath) {
+            throw new errors_1.WebWorkbenchError(409, 'Session belongs to another Workspace.', 'session_workspace_conflict');
+        }
+        const runtime = await this.createSessionRuntime(workspace.canonicalPath);
+        runtime.setSession(session);
+        const actorRef = {};
+        const eventSink = {
+            emit: (event) => this.emitSessionActorRuntimeEvent(key, runtime, actorRef.current, event),
+        };
+        const controller = new agent_runtime_controller_1.AgentRuntimeController({
+            runtime,
+            eventSink,
+            uiRenderer: 'web',
+            echoSubmittedInput: false,
+            useRuntimeToolPermissions: true,
+            uiCapabilities: {
+                structuredPickers: true,
+                inlineProgress: true,
+                suppressLegacyTokenMeta: true,
+                extraAssistantSpacing: true,
+                suppressAbortNotice: true,
+            },
+        });
+        const actor = {
+            key: Object.freeze({ ...key }),
+            runtime,
+            controller,
+            composerRevision: (0, crypto_1.randomUUID)(),
+            latestStatus: 'Ready',
+            suppressComposerEdges: 0,
+        };
+        actorRef.current = actor;
+        actor.composerStoreUnsubscribe = runtime.store.subscribe(() => this.scheduleActorComposerStateChanged(actor));
+        actor.composerControlsUnsubscribe = runtime.sessionComposerControls?.subscribe(() => this.scheduleActorComposerStateChanged(actor));
+        return actor;
+    }
+    async closeSessionActor(actor, _reason) {
+        if (actor.composerChangeTimer)
+            clearTimeout(actor.composerChangeTimer);
+        actor.composerChangeTimer = undefined;
+        actor.composerStoreUnsubscribe?.();
+        actor.composerControlsUnsubscribe?.();
+        actor.composerStoreUnsubscribe = undefined;
+        actor.composerControlsUnsubscribe = undefined;
+        await actor.controller.stopActiveTurn();
+        await actor.controller.waitForIdle();
+        await actor.runtime.shutdown();
+        this.activeOrionRuntimes.delete(actor.key.sessionId);
+        for (const [invocationId, owner] of this.workspaceMutationOwners) {
+            if (owner.sessionId === actor.key.sessionId && owner.workspaceId === actor.key.workspaceId) {
+                this.workspaceMutationOwners.delete(invocationId);
+                this.pendingWorkspaceMutationStates.delete(invocationId);
+            }
+        }
+    }
+    emitSessionActorRuntimeEvent(key, runtime, actor, event) {
+        if (event.type === 'status_changed' && actor)
+            actor.latestStatus = event.message;
+        if (event.type === 'followup_queue_changed') {
+            if (actor && actor.suppressComposerEdges === 0) {
+                this.publishActorComposerState(actor);
+            }
+            return undefined;
+        }
+        if (event.type === 'tool_started') {
+            this.workspaceMutationOwners.set(event.event.callId, Object.freeze({ ...key }));
+        }
+        const thread = this.activeOrionRuntimes.get(key.sessionId)?.thread.getProjection().threadId;
+        const envelope = this.eventHub.emitRuntime(event, {
+            sessionId: key.sessionId,
+            ...(thread ? { threadId: thread } : {}),
+        });
+        if (event.type === 'tool_started') {
+            const pendingMutation = this.pendingWorkspaceMutationStates.get(event.event.callId);
+            if (pendingMutation) {
+                this.pendingWorkspaceMutationStates.delete(event.event.callId);
+                this.emitWorkspaceMutationState(pendingMutation);
+            }
+        }
+        if (event.type === 'permission_requested' && actor) {
+            this.sessionRegistry.setPendingApprovalCount(key, actor.controller.getPendingPermissions().length);
+        }
+        if (event.type === 'tool_finished' && key.workspaceId === this.activeWorkspaceEntry().id) {
+            this.scheduleWorkspaceResourceInvalidation('tool-finished');
+        }
+        if (event.type === 'tool_finished') {
+            this.workspaceMutationOwners.delete(event.event.callId);
+            this.pendingWorkspaceMutationStates.delete(event.event.callId);
+        }
+        return event.type === 'transcript_append' ? `web-entry-${envelope.cursor}` : undefined;
+    }
+    emitWorkspaceMutationState(state) {
+        if (this.closed || this.suppressContextEdges > 0)
+            return;
+        const owner = this.workspaceMutationOwners.get(state.invocationId);
+        if (!owner) {
+            if (state.phase === 'queued' || state.phase === 'running') {
+                this.pendingWorkspaceMutationStates.set(state.invocationId, Object.freeze({ ...state }));
+            }
+            else {
+                this.pendingWorkspaceMutationStates.delete(state.invocationId);
+            }
+            return;
+        }
+        this.eventHub.emit({
+            type: 'workspace_mutation_changed',
+            state: {
+                callId: state.invocationId,
+                phase: state.phase,
+                ...(state.queuePosition === undefined ? {} : { queuePosition: state.queuePosition }),
+            },
+        }, false, { sessionId: owner.sessionId });
+        if (['completed', 'failed', 'cancelled'].includes(state.phase)) {
+            this.workspaceMutationOwners.delete(state.invocationId);
+            this.pendingWorkspaceMutationStates.delete(state.invocationId);
+        }
+    }
+    scheduleActorComposerStateChanged(actor) {
+        if (this.closed || actor.suppressComposerEdges > 0)
+            return;
+        if (actor.composerChangeTimer)
+            clearTimeout(actor.composerChangeTimer);
+        actor.composerChangeTimer = setTimeout(() => {
+            actor.composerChangeTimer = undefined;
+            if (this.closed || actor.suppressComposerEdges > 0)
+                return;
+            this.publishActorComposerState(actor);
+        }, 100);
+        actor.composerChangeTimer.unref();
+    }
+    publishActorComposerState(actor) {
+        try {
+            const state = this.projectActorComposerState(actor, requireSession(actor.key.sessionId));
+            this.eventHub.emit({ type: 'composer_state_changed', state }, true, {
+                sessionId: actor.key.sessionId,
+            });
+        }
+        catch {
+            // A concurrent actor teardown publishes its final Runtime summary.
+        }
     }
     async installRuntime(workspace, publishState = true) {
+        // Every control-plane install reloads the Workspace catalog, provider
+        // wiring, Skills and MCP adapters, so this counter proxies "catalog
+        // reload" for the runtime-ownership diagnostics matrix.
+        this.sessionActivity.controlPlaneInstalls += 1;
         this.closeComposerObserver();
         const runtime = await this.createRuntime(workspace);
         this.closeWorkspaceWatchers();
@@ -1240,7 +1809,7 @@ class WebWorkbenchController {
         const sessionId = this.runtimeValue.getSession()?.id ?? null;
         if (sessionId) {
             try {
-                this.composerAuthorityDigest = composerAuthorityDigest(this.projectComposerStateValue(requireSession(sessionId), true));
+                this.composerAuthorityDigest = composerAuthorityDigest(this.projectComposerStateValue(requireSession(sessionId)));
             }
             catch {
                 this.composerAuthorityDigest = undefined;
@@ -1398,6 +1967,7 @@ class WebWorkbenchController {
                 this.rememberSessionView(sessionId, activation.view);
             }
             this.activeOrionRuntime = { runtime, sessionId };
+            this.activeOrionRuntimes.set(sessionId, runtime);
         }
         catch (error) {
             unsubscribe();
@@ -1407,6 +1977,9 @@ class WebWorkbenchController {
             unsubscribe();
             if (this.activeOrionRuntime?.runtime === runtime)
                 this.activeOrionRuntime = undefined;
+            if (this.activeOrionRuntimes.get(sessionId) === runtime) {
+                this.activeOrionRuntimes.delete(sessionId);
+            }
         };
     }
     loadSessionView(session, activeProjection) {
@@ -1455,20 +2028,44 @@ class WebWorkbenchController {
     assertReadyForTransition(operation) {
         if (this.closed)
             throw new errors_1.WebWorkbenchError(503, 'Web Workbench is closed.');
-        if (this.transition || this.sessionTransition) {
+        if (this.transition || this.activeMutationCount > 0) {
             throw new errors_1.WebWorkbenchError(409, 'A workspace transition is running.', 'runtime_busy');
         }
         if (this.controllerValue.hasActiveTurn()) {
             throw new errors_1.WebWorkbenchError(409, `Cannot ${operation} while a turn is active.`, 'runtime_busy');
         }
+        // P1-A: Session actors are scoped to their own Workspace and survive a
+        // Context switch (WEB35-P0-08/09), so an active actor in a non-target
+        // Workspace must not block switching the active control plane.
     }
     assertMutationAdmission() {
         if (this.closed)
             throw new errors_1.WebWorkbenchError(503, 'Web Workbench is closed.');
-        if (this.transition || this.sessionTransition) {
+        if (this.transition) {
             throw new errors_1.WebWorkbenchError(409, 'A Context transition is running.', 'runtime_busy');
         }
     }
+    reserveMutation(contextTransition) {
+        this.assertMutationAdmission();
+        if (contextTransition) {
+            if (this.contextTransitionReserved || this.activeMutationCount > 0) {
+                throw new errors_1.WebWorkbenchError(409, 'Another mutation is still running.', 'runtime_busy');
+            }
+            this.contextTransitionReserved = true;
+            return;
+        }
+        if (this.contextTransitionReserved) {
+            throw new errors_1.WebWorkbenchError(409, 'A Context transition is being admitted.', 'runtime_busy');
+        }
+        this.activeMutationCount += 1;
+    }
+    releaseMutation(contextTransition) {
+        if (contextTransition) {
+            this.contextTransitionReserved = false;
+            return;
+        }
+        this.activeMutationCount = Math.max(0, this.activeMutationCount - 1);
+    }
     assertContextGuard(context) {
         this.assertMutationAdmission();
         if (context.expectedContextRevision !== this.contextRevisionValue ||
@@ -1479,13 +2076,25 @@ class WebWorkbenchController {
     assertCommandSession(expectedSessionId) {
         if (this.closed)
             throw new errors_1.WebWorkbenchError(503, 'Web Workbench is closed.');
-        if (this.transition || this.sessionTransition) {
+        if (this.transition) {
             throw new errors_1.WebWorkbenchError(409, 'A Session transition is running.', 'runtime_busy');
         }
         if (this.runtimeValue.getSession()?.id !== expectedSessionId) {
             throw new errors_1.WebWorkbenchError(409, 'The active Session changed before the command was admitted.', 'active_session_changed');
         }
     }
+    assertSessionWorkspace(session) {
+        if (canonicalDirectory(session.projectPath) !== this.workspaceValue) {
+            throw new errors_1.WebWorkbenchError(409, 'Session belongs to another Workspace.', 'session_workspace_conflict');
+        }
+    }
+    sessionActorKey(session) {
+        this.assertSessionWorkspace(session);
+        return Object.freeze({
+            workspaceId: this.activeWorkspaceEntry().id,
+            sessionId: session.id,
+        });
+    }
     assertSettingsAvailable() {
         if (this.closed) {
             throw new errors_1.WebWorkbenchError(503, 'Web Workbench is closed.', 'settings_document_unavailable');
@@ -1532,6 +2141,14 @@ function mapWorkspaceRegistryError(error) {
     }
     return new errors_1.WebWorkbenchError(503, 'Workspace registry is unavailable.');
 }
+function mapSessionRuntimeError(error) {
+    if (error instanceof errors_1.WebWorkbenchError)
+        return error;
+    if (error instanceof session_runtime_registry_1.WebSessionRuntimeRegistryError) {
+        return new errors_1.WebWorkbenchError(error.status, error.message, error.code);
+    }
+    throw error;
+}
 function mapSettingsError(error) {
     if (error instanceof errors_1.WebWorkbenchError)
         return error;
@@ -1743,6 +2360,22 @@ function decodePageCursor(cursor) {
         throw new errors_1.WebWorkbenchError(400, 'Page cursor is invalid.');
     }
 }
+function estimateSessionActorBytes(actor) {
+    try {
+        return Math.max(256 * 1024, Buffer.byteLength(JSON.stringify(actor.runtime.store.getSnapshot()), 'utf8'));
+    }
+    catch {
+        return 256 * 1024;
+    }
+}
+async function captureShutdownFailure(failures, operation) {
+    try {
+        await operation();
+    }
+    catch (error) {
+        failures.push(error);
+    }
+}
 function canonicalDirectory(path) {
     const candidate = (0, path_1.resolve)(path);
     let canonical;