@yadsh/dsh-qa-surface 0.13.0 → 0.14.0

package/lib/client/QaSessionController.js

@@ -4,7 +4,7 @@ import { resolveSlashRoute } from "./slash/slash-router.js";
 import { SLASH_DISABLED_COPY, slashAttachmentsCopy, slashExecuteFailureCopy, slashHostRefusalCopy, slashRefusalCopy, slashWithheldCopy, } from "./slash/copy.js";
 import { canOpenAsCompatibilityReadOnly, QaPolicyAttestationError, } from "./attestation.js";
 import { QaChatIndex } from "./chat-index.js";
-import { isDelegatedSession, visibleSubagentCandidates, } from "./lineage.js";
+import { isDelegatedSession, visibleSubagentCandidates } from "./lineage.js";
 import { SessionAssetRepository } from "./session-assets.js";
 import { createQaSession } from "./create-session.js";
 import { buildQaPromptContent, buildQaSlashAttachments, stageQaFiles, } from "./prompt-content.js";
@@ -17,8 +17,14 @@ import { QA_SESSION_IDLE_STATE } from "./types.js";
 import { waitFor } from "./wait-for.js";
 import { QA_REGENERATE_MARKER } from "./QaTranscriptAdapter.js";
 import { readableSubagentName } from "./settlement.js";
-import { projectBoundSessionState } from "./project-session-state.js";
-import { projectTurnSources, sourceAnchorRoot } from "./turn-sources.js";
+import { hostNamedSubmissionIds, projectBoundSessionState, } from "./project-session-state.js";
+/**
+ * `rc.2` deleted the Host-wide navigation: a Session lives while the view that
+ * retained it holds the reference, so binding a chat means retaining it for as
+ * long as this controller projects it.
+ */
+const QA_SURFACE_SESSION_SOURCE = "qaSurface";
+import { chatLegacyOf, projectTurnSources, sourceAnchorRoot, } from "./turn-sources.js";
 const CONFIGURATION_ERROR = "Настройки помощника недоступны.";
 /**
  * How long a catalog answer stays fresh enough to skip a re-read when the
@@ -32,6 +38,46 @@ const SLASH_CATALOG_STALE_MS = 3_000;
  * second of latency is invisible; the poll only runs while a turn runs.
  */
 const PENDING_POLL_MS = 1_000;
+/**
+ * Source of chat identities. Page-wide rather than per controller: the surface
+ * re-creates this controller whenever the account, the config or the route
+ * changes, and a counter that restarted at its first value would name the new
+ * controller's chat exactly as it named the old one's — which is how a draft,
+ * its attachments and its per-chat UI state walked from one chat into another.
+ * `0` stays with `QA_SESSION_IDLE_STATE`, the snapshot the surface reads before
+ * any controller exists.
+ */
+let chatKeySequence = 0;
+function nextChatKey() {
+    chatKeySequence += 1;
+    return chatKeySequence;
+}
+/** What the strip says when the Host refuses one queue operation. */
+const QUEUE_FAILURE_COPY = {
+    edit: "Не удалось изменить сообщение в очереди. Возможно, оно уже отправлено.",
+    remove: "Не удалось убрать сообщение из очереди. Возможно, оно уже отправлено.",
+    steer: "Не удалось отправить сообщение сразу. Попробуйте ещё раз.",
+};
+/**
+ * Image previews for the Host echo of a queued send. A data URL, not the
+ * composer's blob URL: the composer revokes the blob the moment the send is
+ * accepted, while the Host keeps the echo until its queue occurrence lands.
+ * Files are left out — the Host echo wants a durable attachment reference, and
+ * a staged receipt is a write handle, not one.
+ */
+function submissionImages(attachments) {
+    return attachments.flatMap((attachment) => attachment.kind === "image"
+        ? [
+            {
+                type: "image",
+                value: {
+                    previewUrl: `data:${attachment.mediaType};base64,${attachment.data}`,
+                    name: attachment.name,
+                },
+            },
+        ]
+        : []);
+}
 /**
  * The only module that couples QA behavior to DSH Session/client APIs. It owns
  * the chat lifecycle state machine; the observable wait, browser-local chat
@@ -59,8 +105,11 @@ export class QaSessionController {
     streamPublisher;
     state = QA_SESSION_IDLE_STATE;
     session;
+    /** The reference that keeps {@link session} alive; released with the binding. */
+    sessionReference;
     conversationBinding;
     unsubscribeSession;
+    unsubscribeInbox;
     unsubscribeChat;
     unsubscribeConnection;
     ensuring;
@@ -69,6 +118,18 @@ export class QaSessionController {
     admissionPending = false;
     pendingSubmission;
     pendingSequence = 0;
+    /**
+     * Request ids this binding has seen the Host name — in the Inbox queue or as a
+     * durable transcript row. The mask that keeps an echo the session library
+     * failed to retire from coming back as a question still crossing the
+     * transport: the retirement is `@deepseek-ai/dsh-api-session-controller`'s own
+     * contract, deferred to an animation frame that a surface with no frame clock
+     * never runs, and `projectQueue` in project-session-state.ts carries the
+     * citation, what the substitute costs and does not cost, and the point where
+     * this set is dead code. Kept for the whole binding: a request id is minted per
+     * submission, so an id the Host has named can never belong to a later send.
+     */
+    admittedSubmissions = new Set();
     policyReady = false;
     /** Historical transcript retained after the Host classifies policy drift. */
     compatibilityReadOnly = false;
@@ -79,6 +140,31 @@ export class QaSessionController {
     connectedOnce;
     disposed = false;
     generation = 0;
+    /**
+     * The session the current chat identity names, or null while the chat it
+     * names has no session yet. This is what makes the identity a chat identity
+     * rather than a counter: {@link bind} compares the session it is about to
+     * adopt against it, so any path that ends up in another session takes another
+     * identity — and a draft adopting its first session keeps the one it holds.
+     * It only ever names a session this controller holds: {@link bind} hands it
+     * out once the adoption has cleared every wait that caller asked it to take —
+     * a chat is opened and attested, a subagent transcript is only opened — and
+     * both a failed adoption and {@link unbind} take it back. The converse does
+     * not hold: a held session may name nothing, which is the transcript of an
+     * attestation this chat could not pass and whose caller still reads it. So a
+     * chat whose first send fell short keeps its identity while naming no session,
+     * and the retry — which brings a fresh id — stays in the composer the question
+     * was typed into instead of reading as a move to another chat.
+     */
+    namedSession = null;
+    /**
+     * Chat identity handed to the surface (`QaSessionState.chatKey`). Taken from
+     * the page-wide sequence on every move to another chat, and never when the
+     * bound draft merely creates its session: a component that keeps per-chat
+     * state in React therefore survives the first prompt of a new chat, while two
+     * chats never read the same identity.
+     */
+    chatKey = nextChatKey();
     chatsRevision = 0;
     selectedSubrole;
     adminPreview;
@@ -88,6 +174,9 @@ export class QaSessionController {
     hostApprovals;
     /** Host-side question requests of the bound chat waiting for the operator. */
     hostQuestions;
+    queueRemote;
+    /** Last send the stand had no room for; drives the request-ceiling dialog. */
+    requestQueueNotice = null;
     /** Set while a running turn is polled for parked requests. */
     pendingTimer;
     /**
@@ -146,6 +235,7 @@ export class QaSessionController {
         this.hostSources = new QaHostSourceBridge(this.sourceApi, () => this.accounts?.token() ?? "");
         this.hostApprovals = new QaHostApprovalBridge(options.approvalApi);
         this.hostQuestions = new QaHostQuestionBridge(options.questionApi);
+        this.queueRemote = options.queueStatus;
         this.timeoutMs = options.timeoutMs ?? 15_000;
         this.streamPublisher = new StreamPublisher(options.streamIntervalMs ?? 66);
         this.connectedOnce = this.connection.getSnapshot() !== undefined;
@@ -192,11 +282,22 @@ export class QaSessionController {
         if (this.session === undefined) {
             // A draft chat materializes its session only now: nothing was created
             // when the user pressed "New chat", so the first submission pays for it.
-            if (!this.drafting || this.materializing !== undefined)
+            if (this.materializing !== undefined) {
+                // A first prompt is already paying for the session; this one would
+                // only race it. Say so, because the alternative is a silent drop.
+                this.refuseSend("Чат ещё создаётся. Отправьте сообщение ещё раз.");
                 return undefined;
-            if (!(await this.materializeDraft()) || this.session === undefined) {
+            }
+            if (!this.drafting) {
+                this.refuseSend("Не удалось отправить сообщение: чат не открыт.");
                 return undefined;
             }
+            const created = await this.materializeDraft();
+            // A refusal reports itself inside materializeDraft, with the Host's
+            // reason, and a draft the user left while it was being created is
+            // attested by whichever chat took its place: neither answer here.
+            if (!created || this.session === undefined)
+                return undefined;
         }
         const step = await this.attestPolicy();
         if (step.kind === "stale") {
@@ -269,13 +370,43 @@ export class QaSessionController {
             this.publish();
             return false;
         }
+        // A message that joins the queue of a chat which is already answering costs
+        // the stand no second place — the turn is running anyway — so the ceiling
+        // has nothing to say about it. Read before the round-trip below: asking a
+        // busy Host how busy it is, in order to refuse the very queue that keeps
+        // the busy chat from stalling, would be the wrong answer twice over.
+        const joiningQueue = this.session?.getSnapshot().running === true;
+        if (this.config.session.maxActiveRequests > 0 && !joiningQueue) {
+            // The ceiling is read before anything is spent. A draft chat has no
+            // session yet, so a question this stand has no room for must not
+            // materialize one, must not enter the transcript, and must not leave the
+            // composer — which is what a refusal ahead of `beginSubmission` buys.
+            const bound = this.session;
+            const ceiling = await this.readQueueStatus();
+            // A chat that went away during the read answers for its own sends. One
+            // that merely arrived is this draft's session landing underneath, which
+            // the submission rides exactly the way it always did.
+            if (this.disposed || (bound !== undefined && this.session !== bound))
+                return false;
+            if (ceiling !== null && ceiling.full) {
+                this.requestQueueNotice = ceiling;
+                this.publish();
+                return false;
+            }
+        }
         this.operationError = null;
+        this.requestQueueNotice = null;
+        // A running turn has nowhere for a new question to land but its queue, and
+        // the queue is the Host's state, not the transcript's: echoing it into the
+        // transcript would show the same message twice — once waiting, once sent.
+        const queueing = this.session?.getSnapshot().running === true;
         // Regeneration rides a hidden marker and must never leak it into the UI.
-        const submission = prompt === QA_REGENERATE_MARKER
+        const submission = prompt === QA_REGENERATE_MARKER || queueing
             ? undefined
             : this.beginSubmission(prompt, attachments);
         let accepted = false;
         let target;
+        let echo;
         try {
             target = await this.liveTarget();
             if (target === undefined)
@@ -284,6 +415,7 @@ export class QaSessionController {
                 // Recovery may have replaced the original chat with a fresh session;
                 // reconcile against the actual prompt target, not the abandoned one.
                 submission.baselineUserCount = this.state.messages.filter((message) => message.role === "user").length;
+                submission.baselineTurnEnds = this.durableTurnEndCount();
             }
             let receipts = new Map();
             if (files.length > 0) {
@@ -299,11 +431,30 @@ export class QaSessionController {
                     return false;
                 }
                 receipts = outcome.receipts;
+                // The upload was an external round-trip: the user may have left this
+                // chat or closed the surface while it ran. Re-checked before anything is
+                // written to the state and before the prompt is sent, so a draft meant
+                // for the abandoned chat cannot land in it or in its replacement.
+                if (this.disposed || this.session !== target)
+                    return false;
             }
+            const content = buildQaPromptContent(prompt, attachments, receipts);
+            // A queued send needs the Host's own echo, not the transcript one: the
+            // Host mints the identity the prompt carries, retires the echo when its
+            // queue occurrence arrives, and retires it again when an identified
+            // prompt fails, so the strip never keeps a row the server refused.
+            echo = queueing
+                ? target.beginSubmission({
+                    mode: "queue",
+                    text: prompt,
+                    attachments: submissionImages(attachments),
+                })
+                : undefined;
             this.admissionPending = true;
             this.publish();
-            const content = buildQaPromptContent(prompt, attachments, receipts);
-            const result = await target.prompt(content, "queue");
+            const result = queueing
+                ? await target.prompt(content, "queue", undefined, echo?.requestId)
+                : await target.prompt(content, "queue");
             if (this.session !== target)
                 return false;
             if (!result.ok) {
@@ -321,6 +472,9 @@ export class QaSessionController {
         }
         catch (error) {
             this.admissionPending = false;
+            // The prompt call never completed, so nothing settled the echo; a queued
+            // row would otherwise sit in the strip claiming to be on its way.
+            echo?.abandon();
             console.error("dsh-qa-surface: prompt failed", error);
             if (this.session === target) {
                 this.operationError = "Не удалось отправить сообщение.";
@@ -337,6 +491,37 @@ export class QaSessionController {
             }
         }
     }
+    /**
+     * What the stand answers about its load, or null when it does not answer.
+     *
+     * Every failure here sends the question anyway. The ceiling exists to keep a
+     * weak model from drowning, not to be a door a browser cannot open: an
+     * unreadable count says nothing about the load, and refusing a visitor on
+     * that would be a worse answer than the one they would have got.
+     */
+    async readQueueStatus() {
+        if (this.queueRemote === undefined)
+            return null;
+        try {
+            const result = await this.queueRemote();
+            return result.ok ? result.value : null;
+        }
+        catch (error) {
+            console.error("dsh-qa-surface: queue status unavailable", error);
+            return null;
+        }
+    }
+    /**
+     * Close the request-ceiling dialog. Nothing is retried and nothing is
+     * dropped: the held-back question is still the composer's own text, so asking
+     * it again is the visitor's keystroke, taken once the stand has a place free.
+     */
+    dismissRequestQueueNotice() {
+        if (this.requestQueueNotice === null)
+            return;
+        this.requestQueueNotice = null;
+        this.publish();
+    }
     /**
      * Run one admitted human command. The Host answers it and writes the
      * lifecycle into the session log; this method only decides what the composer
@@ -378,6 +563,12 @@ export class QaSessionController {
                     return false;
                 }
                 receipts = outcome.receipts;
+                // The upload was an external round-trip: the user may have left this
+                // chat or closed the surface while it ran. Re-checked before the command
+                // reaches the Host, so a command meant for the abandoned chat cannot run
+                // in it or in its replacement.
+                if (this.disposed || this.session !== target)
+                    return false;
             }
             const result = await this.slashApi.execute(this.accounts?.token() ?? "", String(target.sessionId), line, buildQaSlashAttachments(attachments, receipts));
             if (this.session !== target)
@@ -529,6 +720,16 @@ export class QaSessionController {
         this.slashViewCache = view;
         return view;
     }
+    /**
+     * Turns the loaded Chat window has recorded as durably finished. The Host
+     * writes one per `turn/end`, so the count only moves on a fact the
+     * transcript itself carries — unlike the session's running bit, which the
+     * list relay can also deliver stale.
+     */
+    durableTurnEndCount() {
+        return chatLegacyOf(this.conversationBinding?.snapshot.getSnapshot())
+            .turnEnds.size;
+    }
     /** Publish a browser-only copy before any network or Host admission awaits. */
     beginSubmission(text, attachments) {
         const submission = {
@@ -560,8 +761,8 @@ export class QaSessionController {
                     : []),
             },
             baselineUserCount: this.state.messages.filter((message) => message.role === "user").length,
+            baselineTurnEnds: this.durableTurnEndCount(),
             accepted: false,
-            sawRunning: false,
         };
         this.pendingSubmission = submission;
         this.publish();
@@ -596,11 +797,54 @@ export class QaSessionController {
         }
         this.publish();
     }
+    /**
+     * Edit, send now, or drop one message that still waits for its turn. Every
+     * operation addresses the occurrence id the Host's queue frame carried, so a
+     * row the agent claimed a moment ago is refused by the Host rather than
+     * quietly dropped here.
+     *
+     * The answer is the refusal text rather than a flag, and the strip beside the
+     * composer keeps showing it: a session frame follows a refusal within
+     * milliseconds, and the shared error line is cleared by exactly that frame.
+     */
+    async queueAction(id, action, text = "") {
+        const target = this.session;
+        if (target === undefined || !this.state.canEditQueue)
+            return null;
+        const wire = action === "remove"
+            ? { kind: "remove" }
+            : action === "steer"
+                ? { kind: "steer" }
+                : { kind: "edit", content: [{ type: "text", text }] };
+        try {
+            const result = await target.updateQueue(
+            // The strip holds the id as text; only the Host's brand knows it back.
+            id, wire);
+            if (this.session !== target)
+                return null;
+            if (!result.ok)
+                return QUEUE_FAILURE_COPY[action];
+            this.publish();
+            return null;
+        }
+        catch (error) {
+            console.error("dsh-qa-surface: queue operation failed", error);
+            if (this.session !== target)
+                return null;
+            return QUEUE_FAILURE_COPY[action];
+        }
+    }
     /**
      * Enter the "new chat" draft: show an empty composer without creating any
      * session. Nothing appears in the chat list and no Host session is spent
      * until the first prompt is actually sent, which materializes the session
      * lazily ({@link materializeDraft}). Fixed-policy deployments cannot draft.
+     *
+     * A draft is a chat of its own, so entering one takes the screen the way
+     * {@link switchTo} does; see the note where the generation moves. Stopping the
+     * turn that was running first takes a round-trip, and a chat opened through it
+     * keeps the screen: the draft is what the visitor asked for before that click,
+     * so this call gives up rather than taking the chat back from under them.
      */
     async startDraft(policyChange = false) {
         if (this.disposed ||
@@ -610,6 +854,7 @@ export class QaSessionController {
                 !this.config.lockdown.allowSessionReset))
             return;
         const previous = this.session;
+        const owned = this.generation;
         if (!this.compatibilityReadOnly &&
             previous?.getSnapshot().running === true) {
             try {
@@ -618,15 +863,32 @@ export class QaSessionController {
             catch (error) {
                 console.error("dsh-qa-surface: stop before draft failed", error);
             }
+            // Asking the Host to stop a running turn is a round-trip, and the visitor
+            // reaches the chat list through it. Whoever took the screen during that
+            // window owns it: a draft asked for before the trip would otherwise take
+            // the screen back, unbind the chat that had just been adopted, and answer
+            // its send with nothing — the same takeover this method's own generation
+            // raise exists to stop.
+            if (this.disposed || this.generation !== owned)
+                return;
         }
+        // Taking the screen from the chat it was showing moves the generation, as
+        // every other path that retires a binding does: an adoption still looking
+        // for its session measures itself against that generation, and would
+        // otherwise take the screen back for the chat the visitor just left. Its
+        // materialization goes the same way — it belongs to the ending chat, and must
+        // not hold this draft in "chat still being created" until a round-trip nobody
+        // is waiting for answers.
+        this.generation += 1;
+        this.materializing = undefined;
         this.drafting = true;
-        this.pendingSubmission = undefined;
+        this.openChat();
         this.unbind();
         this.operationError = null;
-        this.admissionPending = false;
         this.policyReady = false;
         this.state = {
             ...QA_SESSION_IDLE_STATE,
+            chatKey: this.chatKey,
             chatsRevision: this.chatsRevision,
         };
         this.publish();
@@ -652,7 +914,12 @@ export class QaSessionController {
                 });
                 if (this.disposed || operation !== this.generation)
                     return false;
-                await this.bind(id);
+                // A step back is not a materialized draft: this adoption never ended up
+                // holding a session, so the draft has to stay a draft. Calling it done
+                // leaves a chat with neither a session nor a draft behind, and every
+                // later question in it answered with "chat not open".
+                if (!(await this.bind(id, { operation })))
+                    return false;
                 if (this.disposed || operation !== this.generation)
                     return false;
                 this.drafting = false;
@@ -692,14 +959,14 @@ export class QaSessionController {
             return;
         const operation = ++this.generation;
         this.drafting = false;
-        this.pendingSubmission = undefined;
+        this.openChat();
         this.viewingSubagent = null;
         this.unbind();
         this.operationError = null;
-        this.admissionPending = false;
         this.policyReady = false;
         this.state = {
             ...QA_SESSION_IDLE_STATE,
+            chatKey: this.chatKey,
             chatsRevision: this.chatsRevision,
             phase: "creating",
         };
@@ -721,7 +988,15 @@ export class QaSessionController {
                 this.forgetChat(sessionId);
                 throw new Error("Этот чат больше недоступен.");
             }
-            await this.bind(sessionId, { allowCompatibilityReadOnly: true });
+            const adopted = await this.bind(sessionId, {
+                operation,
+                allowCompatibilityReadOnly: true,
+            });
+            // The chat this switch was asked for is on screen only if this adoption
+            // finished: a step back means another chat took the screen in the meantime,
+            // and persisting this id as the open one would reopen it on the next load.
+            if (!adopted)
+                return;
             if (this.disposed || operation !== this.generation)
                 return;
             this.chats.saveActive(sessionId);
@@ -751,14 +1026,14 @@ export class QaSessionController {
         }
         const operation = ++this.generation;
         this.drafting = false;
-        this.pendingSubmission = undefined;
+        this.openChat();
         this.viewingSubagent = { id, title };
         this.unbind();
         this.operationError = null;
-        this.admissionPending = false;
         this.policyReady = false;
         this.state = {
             ...QA_SESSION_IDLE_STATE,
+            chatKey: this.chatKey,
             chatsRevision: this.chatsRevision,
             viewingSubagent: this.viewingSubagent,
             phase: "creating",
@@ -766,7 +1041,16 @@ export class QaSessionController {
         this.emit();
         try {
             await this.waitForConnection();
-            await this.bind(id, { attest: false, track: false, report: false });
+            // A step back here is the visitor having left this view for another chat,
+            // which shows its own transcript — there is nothing of ours left to publish
+            // and nothing of theirs to mark as a failed open.
+            if (!(await this.bind(id, {
+                operation,
+                attest: false,
+                track: false,
+                report: false,
+            })))
+                return;
         }
         catch (error) {
             // A newer operation superseded this view request: leave its state alone.
@@ -875,6 +1159,7 @@ export class QaSessionController {
         this.drafting = false;
         this.state = {
             ...QA_SESSION_IDLE_STATE,
+            chatKey: this.chatKey,
             chatsRevision: this.chatsRevision,
             phase: "creating",
         };
@@ -926,10 +1211,15 @@ export class QaSessionController {
             // replace it. A freshly created session must report a refusal at once —
             // it is the deployment's only chance to learn the reason.
             try {
-                await this.bind(id, {
+                // A step back is not a refusal: another operation owns the screen now,
+                // so this bootstrap must neither run its recovery ladder over it nor
+                // persist a chat it never adopted.
+                if (!(await this.bind(id, {
+                    operation,
                     report: !restored,
                     allowCompatibilityReadOnly: existing,
-                });
+                })))
+                    return;
             }
             catch (error) {
                 // A stale restore must not start its recovery ladder against a newer
@@ -947,6 +1237,9 @@ export class QaSessionController {
                 this.unbind();
                 this.operationError = null;
                 this.chats.clearActive();
+                // Nothing is published for the replacement yet: until it exists this is
+                // still the chat on screen, and a fresh session the stand refuses to
+                // create must not cost the visitor the draft they were reading.
                 id = await createQaSession({
                     createSession: this.createSessionRemote,
                     token: this.accounts?.token() ?? "",
@@ -955,7 +1248,15 @@ export class QaSessionController {
                 });
                 if (this.disposed || operation !== this.generation)
                     return;
-                await this.bind(id);
+                // The replacement is another chat — empty, and not one the user asked to
+                // open — so it takes an identity of its own, dropping the refused chat's
+                // unsent text, staged attachments and drawers rather than handing them
+                // to a conversation nobody chose. The bind that refused it left the
+                // identity naming no session, so without this the replacement would
+                // adopt the refused chat's.
+                this.openChat();
+                if (!(await this.bind(id, { operation })))
+                    return;
             }
             if (this.disposed || operation !== this.generation)
                 return;
@@ -991,14 +1292,14 @@ export class QaSessionController {
         }
         const operation = ++this.generation;
         this.unbind();
-        this.admissionPending = false;
         this.policyReady = false;
         this.state = { ...this.state, phase: "creating" };
         this.emit();
         try {
             await this.waitForConnection();
             try {
-                await this.bind(id);
+                if (!(await this.bind(id, { operation })))
+                    return null;
                 if (this.disposed || operation !== this.generation)
                     return null;
                 if (this.policyReady)
@@ -1014,6 +1315,11 @@ export class QaSessionController {
                 this.fail(CONFIGURATION_ERROR, new QaPolicyAttestationError());
                 return null;
             }
+            // Only a chat that never received a prompt is replaced here, so the fresh
+            // id continues the chat the user is writing into: leaving the binding
+            // above takes the identity's name back, and bind() then adopts the fresh
+            // id under the identity still on screen — the question this send carries
+            // has not left the composer.
             this.unbind();
             this.chats.clearActive();
             const created = await createQaSession({
@@ -1024,7 +1330,8 @@ export class QaSessionController {
             });
             if (this.disposed || operation !== this.generation)
                 return null;
-            await this.bind(created);
+            if (!(await this.bind(created, { operation })))
+                return null;
             if (this.disposed || operation !== this.generation)
                 return null;
             this.chats.saveActive(created);
@@ -1039,17 +1346,92 @@ export class QaSessionController {
             return null;
         }
     }
-    async bind(id, options = {}) {
-        const { report = true, attest = true, track = true, allowCompatibilityReadOnly = false, } = options;
-        this.sessions.open(id);
+    /**
+     * Begin a chat of its own: take a fresh identity from the page-wide sequence,
+     * leave it naming no session, and retire the send the ending chat had in
+     * flight. Called on every move between chats — reset, switch, subagent view —
+     * by {@link bind} when it ends up in a session the identity does not name, and
+     * by the bootstrap whose restored chat was refused, for the replacement it is
+     * about to open.
+     */
+    openChat() {
+        this.namedSession = null;
+        this.chatKey = nextChatKey();
+        // A send in flight belongs to the chat that is ending. The projection reads
+        // the optimistic row and the busy flag out of it without asking which chat
+        // is on screen, so unless it dies here, the chat that takes this identity
+        // shows a question it never received and waits for a send it never made.
+        this.pendingSubmission = undefined;
+        this.admissionPending = false;
+    }
+    /**
+     * Adopt one Host session as the chat on screen: take its binding, wait for it
+     * to open, attest the policy, and only then hand the chat identity to the
+     * session, so {@link namedSession} never names one this controller does not
+     * hold. A caller that asks for no attestation — the subagent view, whose
+     * transcript is read rather than written into — is named once its session is
+     * open.
+     *
+     * Answers whether the adoption happened. `true` is a finished one: this call
+     * holds the session and the chat identity names it, so the caller may publish
+     * what it kept for that chat — the draft it retired, the id it persisted.
+     * `false` is a step back: the chat on screen moved on while this call waited,
+     * it undoes nothing of the chat that replaced it and leaves the screen holding
+     * nothing of this one ({@link stepBack}), and the caller must keep its own
+     * state as unclaimed — a draft that was never materialized stays a draft, and a
+     * chat that was never adopted is not persisted as the open one.
+     *
+     * Any of those waits can outlive the operation it belongs to — the user moves
+     * to another chat while a first send is still looking for its session. Two
+     * questions decide that at each wait: is this still the generation the caller
+     * owns, and is this still the session this call took? The first is the page's
+     * own — every path that takes the screen raises the generation. The second is
+     * kept beside it because a generation only records who was asked to start, not
+     * what the controller holds by the time an adoption resumes: a binding
+     * somebody else retired in between is no more this one's to finish.
+     */
+    async bind(id, options) {
+        const { operation, report = true, attest = true, track = true, allowCompatibilityReadOnly = false, } = options;
+        const reference = this.sessions.retain(id, {
+            source: QA_SURFACE_SESSION_SOURCE,
+        });
         let binding = this.sessions.binding(id);
-        if (binding === undefined) {
-            await waitFor(this.sessions.list, (snapshot) => Object.hasOwn(snapshot.byId, id), this.timeoutMs);
-            binding = this.sessions.binding(id);
+        try {
+            if (binding === undefined) {
+                await reference.ready;
+                binding = this.sessions.binding(id);
+            }
+            if (binding === undefined) {
+                await waitFor(this.sessions.list, (snapshot) => Object.hasOwn(snapshot.byId, id), this.timeoutMs);
+                binding = this.sessions.binding(id);
+            }
+        }
+        finally {
+            // A binding this controller never got to hold must not leave a reference
+            // counting against the Session it could not show.
+            if (binding === undefined)
+                reference.release();
         }
         if (binding === undefined)
             throw new Error("Session binding is unavailable.");
+        if (this.disposed || operation !== this.generation) {
+            // A newer operation owns the chat on screen while this one was still
+            // looking for its session. Adopting now would retire the binding that
+            // newer operation is showing, so this one gives up before it takes
+            // anything; the reference it retained is its own to release.
+            reference.release();
+            return false;
+        }
+        // Another session under the identity that named a different one is another
+        // chat: it takes its own identity, so nothing the previous chat was holding
+        // — an unsent question, staged attachments, an open drawer — walks into it.
+        // A chat that names no session adopts under the identity it already has,
+        // which is what keeps a retried first send — it brings a fresh id — in the
+        // composer the question was typed into.
+        if (this.namedSession !== null && this.namedSession !== id)
+            this.openChat();
         this.unbind();
+        this.sessionReference = reference;
         this.session = binding.session;
         this.conversationBinding = this.conversation.binding(id);
         this.policyReady = false;
@@ -1059,6 +1441,12 @@ export class QaSessionController {
             this.operationError = null;
             this.publishSessionUpdate();
         });
+        // The queue strip reads the Inbox projection, which the Host publishes on
+        // its own channel: a claim or a splice changes no session snapshot, so the
+        // strip would otherwise keep the rows the agent has already taken.
+        this.unsubscribeInbox = binding.session.projections
+            .faceOf("inbox")
+            .subscribe(() => this.publishSessionUpdate());
         // Subscribing the Chat target activates it, so the assembled transcript
         // (nodes, partials, running calls) materializes for the projection.
         this.unsubscribeChat = this.conversationBinding
@@ -1066,42 +1454,128 @@ export class QaSessionController {
             .subscribe(() => {
             this.publishSessionUpdate();
         });
-        await waitFor(binding.session, (snapshot) => snapshot.openState === "open" || snapshot.openState === "error", this.timeoutMs);
-        if (binding.session.getSnapshot().openState !== "open") {
-            throw new Error("Session binding could not be opened.");
-        }
-        if (attest) {
-            const step = await this.attestPolicy(report);
-            if (step.kind === "refused") {
-                if (!allowCompatibilityReadOnly ||
-                    !canOpenAsCompatibilityReadOnly(step.reason)) {
-                    throw new QaPolicyAttestationError(step.reason);
+        try {
+            await waitFor(binding.session, (snapshot) => snapshot.openState === "open" || snapshot.openState === "error", this.timeoutMs);
+            if (binding.session.getSnapshot().openState !== "open") {
+                throw new Error("Session binding could not be opened.");
+            }
+            if (attest) {
+                // Attestation both reads and writes the chat on screen: it proves the
+                // session the controller holds and stamps this adoption's verdict onto
+                // it. Ask the two questions before spending a proof on the wrong chat,
+                // and answer only for the session this call took — not for whichever
+                // one the screen holds by the time the proof comes back.
+                if (this.stepBack(operation, binding.session))
+                    return false;
+                const step = await this.attestPolicy(report, binding.session);
+                // A chat that moved on during the proof is attested by whichever
+                // adoption holds it now, so this verdict is not this one's to write.
+                if (this.stepBack(operation, binding.session))
+                    return false;
+                if (step.kind === "refused") {
+                    if (!allowCompatibilityReadOnly ||
+                        !canOpenAsCompatibilityReadOnly(step.reason)) {
+                        throw new QaPolicyAttestationError(step.reason);
+                    }
+                    // The Host classified the existing binding before returning these
+                    // reason classes. Preserve the transcript, but never mark the binding
+                    // policy-ready: every mutating operation remains disabled.
+                    this.compatibilityReadOnly = true;
+                    this.operationError = null;
                 }
-                // The Host classified the existing binding before returning these
-                // reason classes. Preserve the transcript, but never mark the binding
-                // policy-ready: every mutating operation remains disabled.
-                this.compatibilityReadOnly = true;
-                this.operationError = null;
             }
-            else if (step.kind !== "ok") {
-                throw new QaPolicyAttestationError();
+            if (this.stepBack(operation, binding.session)) {
+                // The chat on screen moved on while this adoption waited: what replaced
+                // it holds the identity now, so there is nothing here left to finish —
+                // and this call gives back the binding it installed, which is all the
+                // screen ever took from it.
+                return false;
+            }
+            if (track) {
+                this.chatSessionId = String(binding.session.sessionId);
+                this.viewingSubagent = null;
+                this.chats.addChat(String(binding.session.sessionId));
+                this.accounts?.onSessionCreated(String(binding.session.sessionId));
             }
         }
-        if (track) {
-            this.chatSessionId = String(this.session.sessionId);
-            this.viewingSubagent = null;
-            this.chats.addChat(String(this.session.sessionId));
-            this.accounts?.onSessionCreated(String(this.session.sessionId));
+        catch (error) {
+            // An adoption that fell short must not leave the chat naming the session
+            // it could not finish with: a retried first send brings another id, and an
+            // identity still pointing here would read that retry as a move to another
+            // chat — rebuilding the composer over the very question that has to go
+            // again. A session that never opened is not one this controller holds, so
+            // it goes too; a session whose attestation was refused stays, because its
+            // caller reads the transcript before deciding whether the chat may be
+            // replaced. Once a newer chat has retired the binding this call took, none
+            // of it is ours to undo — that chat owns the identity from then on, and
+            // there is nothing of ours left installed.
+            if (this.ownsAdoption(operation, binding.session)) {
+                this.namedSession = null;
+                if (!(error instanceof QaPolicyAttestationError))
+                    this.unbind();
+            }
+            else if (this.session === binding.session) {
+                // Left behind, and the failure is not a caller's to read any more: the
+                // hand that took the screen was the bootstrap, which retires nothing, so
+                // this adoption's own binding and subscriptions go with this throw.
+                this.unbind();
+            }
+            throw error;
         }
+        // Every wait this adoption was asked to take is behind it: only now does the
+        // chat take this session as its identity.
+        this.namedSession = id;
         this.publish();
         // Deliberately not awaited: the palette is a convenience, and a chat must
         // open at once whether or not the skill and command registries answer.
         void this.refreshSlashCatalog(true);
+        return true;
+    }
+    /**
+     * Give up on an adoption the chat on screen has outgrown, and answer whether
+     * that is what happened (`true` — the caller has nothing left to publish).
+     *
+     * Past the binding this call installed a session of its own: the retained
+     * reference, the three subscriptions beside it, and whatever those
+     * subscriptions write on every frame. The path that took the screen usually
+     * retired all of that with its own {@link unbind} — but the bootstrap raises the
+     * generation while keeping the transcript readable until its own session
+     * exists, and an adoption left behind by it would otherwise go on holding a
+     * Host session nobody is in and publishing that chat's frames into the surface:
+     * each frame clears the error the bootstrap published and answers for a binding
+     * the page has given up on. Undoing the install is therefore this call's own
+     * hand — and only its own: the chat that already replaced this one holds the
+     * name, the subscriptions and the policy proof, and emptying its screen is the
+     * failure this method exists to prevent.
+     */
+    stepBack(operation, session) {
+        if (this.ownsAdoption(operation, session))
+            return false;
+        if (this.session === session)
+            this.unbind();
+        return true;
+    }
+    /**
+     * Is this adoption still the one on screen? The generation says whether the
+     * operation that asked for it still owns the page — every path that takes the
+     * screen raises it, {@link startDraft} among them — and the session says
+     * whether the binding this call took is still the one held, which a generation
+     * alone cannot answer: a newer chat raises it before it has taken any name, and
+     * a caller can retire the binding it holds inside its own generation.
+     */
+    ownsAdoption(operation, session) {
+        return (!this.disposed &&
+            operation === this.generation &&
+            this.session === session);
     }
     unbind() {
+        this.sessionReference?.release();
+        this.sessionReference = undefined;
         this.streamPublisher.clear();
         this.unsubscribeSession?.();
         this.unsubscribeSession = undefined;
+        this.unsubscribeInbox?.();
+        this.unsubscribeInbox = undefined;
         this.unsubscribeChat?.();
         this.unsubscribeChat = undefined;
         this.conversationBinding = undefined;
@@ -1111,6 +1585,10 @@ export class QaSessionController {
             this.assets.release(String(this.session.sessionId));
         }
         this.session = undefined;
+        // A chat that holds no session names no session: {@link bind} hands the
+        // identity out only at the end of a finished adoption, and leaving a
+        // binding is the hand that takes it back.
+        this.namedSession = null;
         this.hostSources.reset();
         this.hostApprovals.reset();
         this.hostQuestions.reset();
@@ -1118,6 +1596,12 @@ export class QaSessionController {
         // The next binding probes the Host again even for the same chat.
         this.pendingProbeKey = "";
         this.admissionPending = false;
+        // Request ids are minted per submission, so another chat's queue listing
+        // says nothing about this one's submissions still crossing the transport.
+        this.admittedSubmissions.clear();
+        // A held-back question belongs to the chat that asked it; another binding
+        // answers for its own sends.
+        this.requestQueueNotice = null;
         this.policyReady = false;
         this.compatibilityReadOnly = false;
         // The catalog belongs to the chat that produced it: another chat has a
@@ -1137,6 +1621,11 @@ export class QaSessionController {
     /** Project one session notification; the running-turn spacing policy
      * (first frame at once, further frames absorbed) lives in the publisher. */
     publishSessionUpdate() {
+        // Read before the spacing, from the notification itself: a frame absorbed
+        // into a running turn's window is dropped rather than replayed, so an
+        // admission landing in such a window would otherwise go unrecorded and the
+        // claim frame after it would draw the ghost row this retires.
+        this.trackAdmittedSubmissions();
         this.streamPublisher.publish(this.session?.getSnapshot().running === true, () => this.publish());
     }
     publish() {
@@ -1150,12 +1639,14 @@ export class QaSessionController {
                 this.pendingSubmission !== undefined;
             this.state = {
                 ...QA_SESSION_IDLE_STATE,
+                chatKey: this.chatKey,
                 phase: materializing
                     ? "creating"
                     : !connected && this.connectedOnce
                         ? "reconnecting"
                         : "idle",
                 error: this.operationError,
+                requestQueue: this.requestQueueNotice,
                 canSend: connected && !materializing,
                 pendingMessage: this.pendingSubmission?.message ?? null,
                 chatsRevision: this.chatsRevision,
@@ -1168,6 +1659,7 @@ export class QaSessionController {
                 ...this.state,
                 phase: !connected && this.connectedOnce ? "reconnecting" : this.state.phase,
                 error: this.operationError ?? this.state.error,
+                requestQueue: this.requestQueueNotice,
             };
             this.emit();
             return;
@@ -1182,9 +1674,11 @@ export class QaSessionController {
         }
         this.probePending(sessionId, connected);
         this.syncPendingPolling(snapshot.running === true && !this.compatibilityReadOnly);
+        const queuedMessages = this.queuedMessages();
         const projectionInput = {
             connected,
             sessionId,
+            chatKey: this.chatKey,
             sessionSnapshot: snapshot,
             conversationSnapshot,
             sourceBundles,
@@ -1194,11 +1688,16 @@ export class QaSessionController {
             // carries its owner's name when an admin reads it.
             author: this.accounts?.messageAuthorOf(sessionId),
             operationError: this.operationError,
+            requestQueue: this.requestQueueNotice,
             policyReady: this.policyReady,
             compatibilityReadOnly: this.compatibilityReadOnly,
             admissionPending: this.admissionPending || this.pendingSubmission !== undefined,
             chatsRevision: this.chatsRevision,
             viewingSubagent: this.viewingSubagent,
+            queuedMessages,
+            // The live set, not a copy: `projectQueue` only asks it `has` and keeps no
+            // reference, so nothing here could go stale by the next frame.
+            admittedSubmissions: this.admittedSubmissions,
             slash: this.slashView(),
             config: this.config,
             subagentNames: this.subagentNames(),
@@ -1206,11 +1705,16 @@ export class QaSessionController {
         let projected = projectBoundSessionState(projectionInput);
         const pending = this.pendingSubmission;
         if (pending !== undefined) {
-            if (snapshot.running)
-                pending.sawRunning = true;
+            // The optimistic copy retires on a fact the transcript itself carries —
+            // its own row arriving, or a turn closing — and not on the session's
+            // running bit: the Session list relays that one too, and a stale false
+            // at the start of a turn retired the copy before the Chat slice had
+            // assembled the node, which is the frame the question vanished in.
             const committedUserCount = projected.messages.filter((message) => message.role === "user").length;
             if (committedUserCount > pending.baselineUserCount ||
-                (pending.accepted && pending.sawRunning && !snapshot.running)) {
+                (pending.accepted &&
+                    chatLegacyOf(conversationSnapshot).turnEnds.size >
+                        pending.baselineTurnEnds)) {
                 this.pendingSubmission = undefined;
                 // The first projection was intentionally busy while the optimistic
                 // row existed. Recompute once so the same notification can restore
@@ -1227,6 +1731,52 @@ export class QaSessionController {
         };
         this.emit();
     }
+    /**
+     * The messages the Host has accepted for the agent's next turn. They arrive
+     * through the session's Inbox projection rather than the snapshot the queue
+     * strip used to read: `rc.2` moved pending input onto the projection surface,
+     * and a key the Host never published reads as no queued work.
+     */
+    queuedMessages() {
+        const inbox = this.session?.projections.faceOf("inbox").getSnapshot();
+        return inbox?.["next-turn"] ?? [];
+    }
+    /**
+     * Record the submissions this binding has seen the Host name — the queue rows
+     * it holds and the durable input rows it has written. Naming the message is the
+     * server's own receipt for it, so from that notification on the row belongs to
+     * the chat, not to the transport: an echo the claim leaves behind must not read
+     * again as a question still crossing. The scan is only paid for while some
+     * queued echo still waits for its name.
+     *
+     * Both lists are read because neither is reliable alone, and the transcript is
+     * the durable one: a send admitted and claimed between two notifications never
+     * appears in a queue frame this browser is handed, but its row stays in the
+     * transcript, so the next frame names it. And the receipt is never dropped
+     * while the binding lives — an id the server has named belongs to the submission
+     * that minted it (`beginSubmission` returns a fresh `randomUUID`), so no later
+     * send can need the row this hides, whereas forgetting the receipt re-draws the
+     * ghost the moment the snapshot registers the echo again.
+     *
+     * Read from the notification, not from the projected frame: the projection of a
+     * running turn is spaced, and an absorbed frame is dropped rather than
+     * replayed, so spacing must not decide whether this browser ever saw the name.
+     */
+    trackAdmittedSubmissions() {
+        const snapshot = this.session?.getSnapshot();
+        if (snapshot === undefined)
+            return;
+        // Only an echo still waiting can draw a row, so a chat whose queued sends are
+        // all settled costs no scan of the transcript — and a browser registers the
+        // echo before it sends, so an id with no echo there has nothing to settle.
+        const unsettled = snapshot.pendingSubmissions.some((item) => item.placement === "queued" &&
+            !this.admittedSubmissions.has(String(item.requestId)));
+        if (!unsettled)
+            return;
+        for (const requestId of hostNamedSubmissionIds(this.queuedMessages(), this.conversationBinding?.snapshot.getSnapshot())) {
+            this.admittedSubmissions.add(requestId);
+        }
+    }
     /**
      * The directory the transcript's source paths are anchored on: the chat's
      * own cwd, never the configured pin while the chat is known.
@@ -1266,7 +1816,7 @@ export class QaSessionController {
         const names = {};
         const list = this.sessions.list.getSnapshot();
         const chats = this.visibleChatIds();
-        const candidates = visibleSubagentCandidates(list.byId ?? {}, (list.subagentsByParent ?? {}), chats);
+        const candidates = visibleSubagentCandidates(list.byId ?? {}, chats);
         for (const candidate of candidates) {
             const name = readableSubagentName(candidate.label, candidate.id);
             if (name !== undefined)
@@ -1284,6 +1834,14 @@ export class QaSessionController {
             return undefined;
         return new Set(this.accounts.ownedIds());
     }
+    /**
+     * Tell the user that a submission they pressed did not go. The composer keeps
+     * its text through a refused send, so silence here would read as success.
+     */
+    refuseSend(message) {
+        this.operationError = message;
+        this.publish();
+    }
     fail(message, error) {
         // Policy attestation refusals already logged their precise reason; a
         // second stack trace for the wrapper error is only console noise.
@@ -1295,6 +1853,7 @@ export class QaSessionController {
         this.operationError = message;
         this.state = {
             ...QA_SESSION_IDLE_STATE,
+            chatKey: this.chatKey,
             phase: "error",
             error: message,
             chatsRevision: this.chatsRevision,
@@ -1302,20 +1861,24 @@ export class QaSessionController {
         this.emit();
     }
     /**
-     * Attest the currently bound session. `ok` carries the session id the proof
-     * was issued for; `stale` means the binding changed while the request was
-     * in flight, so nothing was written — the newer binding manages its own
-     * attestation; `refused` is a genuine admission refusal of this binding.
+     * Attest `session`, which defaults to the one currently bound. `ok` carries
+     * the session id the proof was issued for; `stale` means the binding changed
+     * while the request was in flight, so nothing was written — the newer binding
+     * manages its own attestation; `refused` is a genuine admission refusal of
+     * this binding.
      */
-    async attestPolicy(reportFailure = true) {
-        const session = this.session;
+    async attestPolicy(reportFailure = true, session = this.session) {
         if (session === undefined)
             return { kind: "refused", reason: null };
         const sessionId = String(session.sessionId);
-        if (!this.config.lockdown.enabled) {
+        if (!this.config.lockdown.enabled && this.accounts === undefined) {
             this.policyReady = true;
             return { kind: "ok", sessionId };
         }
+        // With lockdown off there is no policy to pin, but the Host call still
+        // runs: account identity and ownership are admitted there independently of
+        // lockdown, and skipping the call is what let a browser that restored
+        // another account's chat write into it without ever being asked who spoke.
         this.policyReady = false;
         this.publish();
         const outcome = await attestQaPolicy({