commandmate 0.26.1 → 0.27.1

package/dist/server/src/lib/session/agent-event-state.js

@@ -39,7 +39,13 @@
  * @module lib/session/agent-event-state
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.STRUCTURED_PROMPT_PROVISIONAL_MAX_AGE_MS = exports.STRUCTURED_STATE_MAX_AGE_MS = exports.AGENT_EVENT_DEDUP_WINDOW_MS = void 0;
+exports.LIFECYCLE_AGENT_EVENT_TYPES = exports.STRUCTURED_PROMPT_PROVISIONAL_MAX_AGE_MS = exports.STRUCTURED_STATE_MAX_AGE_MS = exports.AGENT_EVENT_DEDUP_WINDOW_MS = void 0;
+exports.getAgentEventDropCounts = getAgentEventDropCounts;
+exports.getPendingDecisions = getPendingDecisions;
+exports.getAgentTurn = getAgentTurn;
+exports.getPublishedAgentTurn = getPublishedAgentTurn;
+exports.closeAgentTurn = closeAgentTurn;
+exports.observeScraperCompletionEvidence = observeScraperCompletionEvidence;
 exports.recordAgentStopEvent = recordAgentStopEvent;
 exports.getLastStopEventAt = getLastStopEventAt;
 exports.recordAgentEvent = recordAgentEvent;
@@ -65,6 +71,8 @@ exports.getAskUserQuestion = getAskUserQuestion;
 exports.clearAskUserQuestion = clearAskUserQuestion;
 exports.isDuplicateAgentEvent = isDuplicateAgentEvent;
 exports.getRecentEventKeyCount = getRecentEventKeyCount;
+exports.classifyAgentEventDelivery = classifyAgentEventDelivery;
+exports.getRecentEventIdentityCount = getRecentEventIdentityCount;
 exports.clearAgentStopEvents = clearAgentStopEvents;
 const auto_yes_state_1 = require("../../lib/auto-yes-state");
 const agent_event_types_1 = require("../../lib/hooks/agent-event-types");
@@ -72,7 +80,9 @@ const permission_request_payload_1 = require("../../lib/hooks/permission-request
 // Issue #1784: the terminal-frame half of "which model / effort is this on".
 const model_info_extractor_1 = require("../../lib/detection/model-info-extractor");
 const status_mapping_1 = require("../../lib/session/status-mapping");
-const structured_prompt_1 = require("../../lib/session/structured-prompt");
+// Issue #1930: the turn model. Pure, so importing it here costs nothing at
+// runtime beyond the two bounds it owns.
+const provisional_turn_1 = require("../../lib/session/provisional-turn");
 /** compositeKey -> epoch ms of the most recent stop event. */
 const lastStopEventAt = globalThis.__agentEventLastStopAt ??
     (globalThis.__agentEventLastStopAt = new Map());
@@ -82,15 +92,54 @@ const lastAgentEvent = globalThis.__agentEventLast ??
 /** compositeKey -> epoch ms the current generation began. See {@link beginAgentEventGeneration}. */
 const generationStartedAt = globalThis.__agentEventGenerationStartedAt ??
     (globalThis.__agentEventGenerationStartedAt = new Map());
-/** compositeKey -> the open dialog the structured layer knows about (#1725). */
-const promptWaiting = globalThis.__agentEventPromptWaiting ??
-    (globalThis.__agentEventPromptWaiting = new Map());
+/**
+ * compositeKey -> the turn this instance is in, or the last one it was in
+ * (Issue #1930).
+ *
+ * The map that replaced "the newest event is the verdict". `lastAgentEvent`
+ * above is still written on every delivery and is still what
+ * `structuredEvents.lastEventType` publishes — it answers "did anything reach
+ * this server, and for the right instance?", which is a diagnostic question.
+ * This map answers the state question, and the two deliberately disagree
+ * whenever an event carries no verdict.
+ *
+ * The open dialogs #1725 kept in a map of their own live on the turn now
+ * ({@link TurnRecord.pendingDecisions}), because a dialog only ever happens
+ * *inside* a turn and holding them apart is what let a generation bump retire
+ * one and not the other.
+ */
+const agentTurns = globalThis.__agentEventTurns ??
+    (globalThis.__agentEventTurns = new Map());
+/** compositeKey -> what this instance has had dropped, and why (Issue #1930). */
+const dropCounts = globalThis.__agentEventDrops ??
+    (globalThis.__agentEventDrops = new Map());
+/**
+ * Monotonic suffix for {@link TurnRecord.turnId}.
+ *
+ * Two turns can open in the same millisecond — a `post_tool_use` closing one
+ * agent's turn while another's `user_prompt_submit` lands — and an id built from
+ * the timestamp alone would then compare equal across instances. `wait` reads a
+ * change of id as "a new turn began", so the collision would be a missed turn
+ * boundary rather than a cosmetic clash.
+ */
+const turnSequence = globalThis.__agentEventTurnSeq ??
+    (globalThis.__agentEventTurnSeq = { value: 0 });
 /** compositeKey -> the `AskUserQuestion` call currently in flight (#1726). */
 const askUserQuestion = globalThis.__agentEventAskUserQuestion ??
     (globalThis.__agentEventAskUserQuestion = new Map());
 /** dedup key -> epoch ms it was first seen. See {@link isDuplicateAgentEvent}. */
 const recentEventKeys = globalThis.__agentEventRecentKeys ??
     (globalThis.__agentEventRecentKeys = new Map());
+/**
+ * compositeKey -> (identity key -> epoch ms it was first seen) (Issue #1899).
+ *
+ * Nested rather than flat so the bound is *per instance*, which the flat
+ * {@link recentEventKeys} is not: one chatty agent must not be able to evict
+ * another's ids and let a genuine re-delivery through on a quiet pane. See
+ * {@link claimEventIdentity}.
+ */
+const recentEventIdentities = globalThis.__agentEventRecentIdentities ??
+    (globalThis.__agentEventRecentIdentities = new Map());
 /** compositeKey -> the agent's own "I am waiting for instructions" (#1786). */
 const awaitingInstruction = globalThis.__agentEventAwaitingInstruction ??
     (globalThis.__agentEventAwaitingInstruction = new Map());
@@ -148,6 +197,209 @@ const capturedModelInfo = globalThis.__agentCapturedModelInfo ??
 exports.AGENT_EVENT_DEDUP_WINDOW_MS = 3000;
 /** Cap on retained dedup keys, so a long-lived server cannot grow one per turn. */
 const MAX_RECENT_EVENT_KEYS = 512;
+/** A zeroed tally. */
+function emptyDropCounts() {
+    return {
+        dedupDropped: { identity: 0, timeWindow: 0 },
+        decisionEvicted: 0,
+        idsDiscarded: 0,
+        dialogTimedOut: 0,
+        decisionOverflow: 0,
+    };
+}
+/** The live tally for one instance, created on first use. */
+function dropsFor(key) {
+    let counts = dropCounts.get(key);
+    if (!counts) {
+        counts = emptyDropCounts();
+        dropCounts.set(key, counts);
+        // The composite key is (worktree, tool, instance) and a long-lived server
+        // accumulates worktrees; bounded like every other map here (DR4-009).
+        trimOldestEntries(dropCounts, MAX_RECENT_EVENT_KEYS);
+    }
+    return counts;
+}
+/**
+ * What this instance has had dropped, or a zeroed tally when nothing has.
+ *
+ * A copy, not the live object: this is published on the hot path and a caller
+ * that could mutate it would be able to erase the evidence.
+ */
+function getAgentEventDropCounts(worktreeId, cliToolId, instanceId) {
+    const counts = dropCounts.get((0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId));
+    if (!counts)
+        return emptyDropCounts();
+    return { ...counts, dedupDropped: { ...counts.dedupDropped } };
+}
+/** Epoch ms the current generation began, or null when none was opened. */
+function currentGeneration(key) {
+    return generationStartedAt.get(key) ?? null;
+}
+/**
+ * The turn this instance is in, with the generation fence applied.
+ *
+ * A turn whose {@link TurnRecord.generationAt} is not the current generation was
+ * opened by a process that has been replaced. It is not deleted — the fence is
+ * cheap and deleting would lose the eviction tally — it is simply not this
+ * instance's turn any more.
+ */
+function fencedTurn(key) {
+    const turn = agentTurns.get(key);
+    if (!turn)
+        return null;
+    if (turn.generationAt !== currentGeneration(key))
+        return null;
+    return turn;
+}
+/**
+ * {@link fencedTurn} with the staleness bound applied.
+ *
+ * The bound is applied by *closing* the turn rather than by hiding it, so
+ * `capture --json` says `closedBy: 'stale'` instead of going quiet — "the agent
+ * never reported the end of this turn" and "nothing has been reported at all"
+ * are different problems and an operator has to be able to tell them apart.
+ *
+ * Writes on read, which this module already does for corroboration, and is
+ * idempotent: the close is stamped from the event's own clock, so it does not
+ * move with the reader's `now`.
+ */
+function effectiveTurn(key, now) {
+    const turn = fencedTurn(key);
+    if (turn === null)
+        return null;
+    if (turn.closedAt === null && now - turn.displayEvent.at >= provisional_turn_1.TURN_STALE_AFTER_MS) {
+        turn.closedAt = turn.displayEvent.at + provisional_turn_1.TURN_STALE_AFTER_MS;
+        turn.closedBy = 'stale';
+    }
+    return turn;
+}
+/** Next {@link TurnRecord.turnId}. See {@link turnSequence}. */
+function nextTurnId(at) {
+    turnSequence.value += 1;
+    return `turn-${at}-${turnSequence.value}`;
+}
+/**
+ * Drop the decisions this turn is holding, counting them.
+ *
+ * The generation path is the one §4 D3 決定 2 names: a process that has been
+ * replaced cannot have its approvals answered, and leaving them behind would
+ * publish `waiting` for a pane whose dialog went away with the process that
+ * drew it.
+ */
+function evictDecisions(key, turn) {
+    if (turn.pendingDecisions.length === 0)
+        return;
+    dropsFor(key).decisionEvicted += turn.pendingDecisions.length;
+    turn.pendingDecisions = [];
+}
+/**
+ * The decisions still describing something, dropping the ones that are not.
+ *
+ * The retention bound of {@link DIALOG_PENDING_MAX_MS}, applied on read and
+ * counted as `dialogTimedOut` so the release is visible. Kept here rather than
+ * in a timer for the reason the rest of this module has no timers: the state
+ * describes a live tmux session, and a reader is the only thing that ever needs
+ * the answer.
+ */
+function livePendingDecisions(key, turn, now) {
+    const live = turn.pendingDecisions.filter((decision) => (0, provisional_turn_1.isDecisionLive)(decision, now));
+    const dropped = turn.pendingDecisions.length - live.length;
+    if (dropped > 0) {
+        dropsFor(key).dialogTimedOut += dropped;
+        turn.pendingDecisions = live;
+    }
+    return live;
+}
+/**
+ * The approvals this instance is blocked on right now (Issue #1930).
+ *
+ * Published as `structuredEvents.pendingDecisions`; `#1932` is what teaches
+ * `commandmate respond` to name one of these ids.
+ *
+ * @param now - Epoch ms; defaults to now
+ */
+function getPendingDecisions(worktreeId, cliToolId, instanceId, now = Date.now()) {
+    const key = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
+    const turn = effectiveTurn(key, now);
+    if (turn === null)
+        return [];
+    return livePendingDecisions(key, turn, now);
+}
+/**
+ * The turn record for one instance, fenced and aged, or null.
+ *
+ * The seam `current-output-builder` publishes from and the suites drive. The
+ * returned object is the live record; nothing outside this module writes to it.
+ *
+ * @param now - Epoch ms; defaults to now
+ */
+function getAgentTurn(worktreeId, cliToolId, instanceId, now = Date.now()) {
+    return effectiveTurn((0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId), now);
+}
+/** {@link getAgentTurn} projected onto the four published fields. */
+function getPublishedAgentTurn(worktreeId, cliToolId, instanceId, now = Date.now()) {
+    return (0, provisional_turn_1.derivePublishedTurn)(getAgentTurn(worktreeId, cliToolId, instanceId, now));
+}
+/**
+ * Close the open turn on evidence that did not come from the agent (Issue #1930).
+ *
+ * The one seam for the two {@link TurnCloseReason} values nothing in the event
+ * stream can produce:
+ *
+ *  - `scraper_evidence` — see {@link observeScraperCompletionEvidence}, which is
+ *    the caller in this tree.
+ *  - `resync_idle` — a source whose `capabilities.resync` lets it be re-read
+ *    answering "not busy" after a dropped transport. The reconnect loop that
+ *    would call it lives in `sources/opencode/subscription`, which is #1931's
+ *    file and deliberately untouched here; the value is in the vocabulary and
+ *    the seam accepts it, so wiring it is a call site rather than a new state.
+ *
+ * A no-op when no turn is open, which is the ordinary case: neither of these is
+ * a statement about a session that already reported it finished.
+ *
+ * @param at - Epoch ms; defaults to now
+ * @returns Whether a turn was closed
+ */
+function closeAgentTurn(worktreeId, cliToolId, instanceId, closedBy, at = Date.now()) {
+    const key = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
+    const turn = fencedTurn(key);
+    if (turn === null || turn.closedAt !== null)
+        return false;
+    turn.closedAt = at;
+    turn.closedBy = closedBy;
+    return true;
+}
+/**
+ * Feed one poll's reading of the pane into the turn's completion counter
+ * (Issue #1930).
+ *
+ * `completed` is the scraper's own verdict — `ready` with positive evidence —
+ * NOT the merged one, which would be circular: the merge is what the structured
+ * layer's `running` overrides, so reading it back would only ever confirm this
+ * layer's own answer.
+ *
+ * See {@link SCRAPER_COMPLETION_POLLS} for why three, and for why closing here
+ * does not complete a `commandmate wait`.
+ *
+ * @param at - Epoch ms; defaults to now
+ * @returns Whether this poll closed the turn
+ */
+function observeScraperCompletionEvidence(worktreeId, cliToolId, instanceId, completed, at = Date.now()) {
+    const key = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
+    const turn = fencedTurn(key);
+    if (turn === null || turn.closedAt !== null)
+        return false;
+    if (!completed) {
+        turn.scraperCompletionPolls = 0;
+        return false;
+    }
+    turn.scraperCompletionPolls += 1;
+    if (turn.scraperCompletionPolls < provisional_turn_1.SCRAPER_COMPLETION_POLLS)
+        return false;
+    turn.closedAt = at;
+    turn.closedBy = 'scraper_evidence';
+    return true;
+}
 /**
  * Record that `instanceId` reported it stopped.
  *
@@ -164,22 +416,100 @@ function recordAgentStopEvent(worktreeId, cliToolId, instanceId, at = Date.now()
 function getLastStopEventAt(worktreeId, cliToolId, instanceId) {
     return lastStopEventAt.get((0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId)) ?? null;
 }
+/**
+ * The verdicts that mean this instance is inside a turn (Issue #1903).
+ *
+ * `waiting` is in the list because a dialog only happens *during* a turn: the
+ * agent asked for permission in the middle of the work it was doing, and the
+ * turn it belongs to is as open as one reading `running`. Leaving it out would
+ * fix the measured copilot window (`UserPromptSubmit` -> `SessionStart`) and
+ * leave the same hole one event further in.
+ *
+ * `ready` (`stop` / `idle_prompt`) and null (no event, a previous generation, a
+ * stale one, or an event with no verdict at all) both mean no turn is open.
+ */
+const OPEN_TURN_STATUSES = ['running', 'waiting'];
+/**
+ * Whether this `session_start` is the current turn's own, arriving late
+ * (Issue #1903).
+ *
+ * copilot 1.0.80 fires `UserPromptSubmit` and *then* `SessionStart`, 12-15 s
+ * later on a first turn — measured twice, and the payload says so itself: the
+ * captured `SessionStart` carries `initial_prompt` with the text of the prompt
+ * that was already submitted. Under the "newest event is the verdict" model
+ * that arrival erased `running / hook_prompt_submit`, because
+ * `agentEventToSessionStatus` answers null for `session_start`; the pane fell
+ * back to the scraper, which reads a generating copilot frame as `ready`
+ * (#1885), and a `commandmate wait` started inside that window exited 0 with
+ * `basis=scraper_ready` while the agent was still thinking.
+ *
+ * The rule is the design policy's (§4 D3 decision 2): *an event carrying no
+ * verdict does not close an open turn*. Here that is expressed as "it does not
+ * replace the event the verdict is read from either", because this model has
+ * one record where the turn model has two fields.
+ *
+ * Three conditions, and each one is load-bearing:
+ *
+ *  1. **The source declares it.** Not a tool id — flip copilot's capability to
+ *     `false` and the late frame overwrites again, flip claude's to `true` and
+ *     claude's would be held. #1901 reads `permissionHookPredictsDialog` the
+ *     same way.
+ *  2. **A turn is open**, judged by {@link getStructuredSessionState} *as of the
+ *     arriving event's own timestamp* — which is how this inherits the
+ *     generation fence and the {@link STRUCTURED_STATE_MAX_AGE_MS} bound rather
+ *     than growing a second copy of either. A `session_start` on an idle
+ *     instance, after a `stop`, or as the first event of a session is recorded
+ *     exactly as it always was, generation bump included. That is what keeps
+ *     `/clear` working: it arrives as `session_end` (verdict null, so the turn
+ *     is no longer open) followed by `session_start`.
+ *  3. **It does not name a different agent session.** A genuine restart inside
+ *     the pane is a different `session_id`, and holding *that* frame would be
+ *     the real cost of this rule — the instance would keep publishing the dead
+ *     process's `running`. When either side is null the two are treated as the
+ *     same session, because "no id" is the shape a hand-configured #1549 hook
+ *     posts and the fix has to survive it; that residue is bounded by
+ *     {@link STRUCTURED_STATE_MAX_AGE_MS}, after which the scraper takes the
+ *     session back, and by `beginAgentEventGeneration` on every session
+ *     CommandMate itself (re)starts.
+ */
+function isLateSessionStart(worktreeId, cliToolId, instanceId, record, options) {
+    if (record.event !== 'session_start')
+        return false;
+    if (options.sessionStartMayArriveLate !== true)
+        return false;
+    const openTurn = getStructuredSessionState(worktreeId, cliToolId, instanceId, record.at);
+    if (openTurn === null || !OPEN_TURN_STATUSES.includes(openTurn.status))
+        return false;
+    const openSessionId = lastAgentEvent.get((0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId))?.sessionId ?? null;
+    if (openSessionId === null || record.sessionId == null)
+        return true;
+    return record.sessionId === openSessionId;
+}
 /**
  * Record any structured event against an instance (Issue #1722).
  *
  * Deliberately does not touch `lastStopEventAt`: that timestamp belongs to
  * `applyAgentStopEvent`, which writes it alongside the task transition it drives
  * so the two cannot disagree.
+ *
+ * @param options - What the delivering source declares about itself (#1903)
+ * @returns Whether the delivery was applied, so the caller can log a held one.
+ *   Callers that do not care may ignore it; every pre-#1903 caller does.
  */
-function recordAgentEvent(worktreeId, cliToolId, instanceId, record) {
+function recordAgentEvent(worktreeId, cliToolId, instanceId, record, options = {}) {
     const key = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
-    lastAgentEvent.set(key, record);
-    // Issue #1783: latch, never clear. An event without a model is the ordinary
-    // case (Claude sends one on `SessionStart` alone), and reading it as "the
-    // model is now unknown" would blank the display on the very next event.
-    if (typeof record.model === 'string' && record.model !== '') {
-        lastAgentModel.set(key, record.model.slice(0, agent_event_types_1.MAX_EVENT_DETAIL_LENGTH));
+    if (isLateSessionStart(worktreeId, cliToolId, instanceId, record, options)) {
+        // Issue #1903. Held, not discarded: the model latch below is not part of
+        // the turn and never was. `SessionStart` is the one event Claude puts a
+        // model on, so a source that both declares this capability and reports a
+        // model would otherwise be the single case where the model is extracted and
+        // then dropped on the floor. copilot reports none today (#1783), which is
+        // exactly why this has to be decided here rather than left to be noticed.
+        latchAgentModel(key, record);
+        return { recorded: false, skipped: 'late-session-start' };
     }
+    lastAgentEvent.set(key, record);
+    latchAgentModel(key, record);
     applyAskUserQuestionTransition(key, record);
     if (record.event === 'session_start') {
         // The agent restarting inside a pane CommandMate never touched — `claude`
@@ -188,9 +518,59 @@ function recordAgentEvent(worktreeId, cliToolId, instanceId, record) {
         // new tmux session is. Recorded from the event's own timestamp, so the
         // event that opens a generation is never stale against it.
         generationStartedAt.set(key, record.at);
+        // Issue #1930: and the turn the previous process was in ends with it. Done
+        // here rather than inside the transition below so the two paths into a new
+        // generation — this one and `beginAgentEventGeneration` — close the turn in
+        // exactly one place.
+        fenceTurnForNewGeneration(key, record.at);
     }
-    applyPromptWaitingTransition(key, record);
+    // Issue #1930: after the generation is settled, so a turn opened by this
+    // event belongs to the generation the event itself opened.
+    applyTurnTransition(key, record);
     applyAwaitingInstructionTransition(key, record);
+    return { recorded: true };
+}
+/**
+ * End the open turn because the process that owned it has been replaced
+ * (Issue #1930).
+ *
+ * The turn is closed and re-stamped into the new generation rather than
+ * deleted, which is the difference between `capture --json` reporting
+ * `closedBy: 'generation'` and reporting nothing at all. Its approvals go: they
+ * were raised by a process that no longer exists, and answering one would
+ * deliver a verdict into a slot nobody is holding.
+ */
+function fenceTurnForNewGeneration(key, at) {
+    const turn = agentTurns.get(key);
+    if (!turn)
+        return;
+    evictDecisions(key, turn);
+    // A turn that had ALREADY ended is left where it is, which means the fence in
+    // `fencedTurn` hides it from here on. That asymmetry is deliberate: the
+    // previous process's `Stop` is not this process's, and re-stamping it into the
+    // new generation would publish `ready` — "the agent finished" — for a session
+    // nobody has typed into yet. Before #1930 the same protection came from
+    // comparing the event's timestamp against the generation.
+    if (turn.closedAt !== null)
+        return;
+    // An OPEN turn is closed and carried across, so `capture --json` can say
+    // `closedBy: 'generation'` rather than going quiet. `getStructuredSessionState`
+    // reads that reason as "nothing is known", so it publishes no verdict either
+    // way; what it buys is an operator being able to tell "the session was
+    // restarted under this turn" from "nothing was ever reported".
+    turn.closedAt = at;
+    turn.closedBy = 'generation';
+    turn.generationAt = at;
+}
+/**
+ * Issue #1783: latch, never clear. An event without a model is the ordinary
+ * case (Claude sends one on `SessionStart` alone), and reading it as "the model
+ * is now unknown" would blank the display on the very next event.
+ */
+function latchAgentModel(key, record) {
+    if (typeof record.model === 'string' && record.model !== '') {
+        lastAgentModel.set(key, record.model.slice(0, agent_event_types_1.MAX_EVENT_DETAIL_LENGTH));
+    }
 }
 /**
  * The third state: "this turn is over and nobody has told me what to do next"
@@ -278,77 +658,93 @@ function isAwaitingInstruction(worktreeId, cliToolId, instanceId) {
     return getAwaitingInstruction(worktreeId, cliToolId, instanceId) !== null;
 }
 /**
- * The `prompt_waiting` half of the state machine, driven by the same events
- * (Issue #1725).
- *
- * | event                             | effect on prompt_waiting |
- * |-----------------------------------|--------------------------|
- * | `notification(permission_prompt)` | **open**, confirmed      |
- * | `notification(idle_prompt)`       | release                  |
- * | `notification(other/none)`        | unchanged                |
- * | `stop`                            | release                  |
- * | `user_prompt_submit`              | release                  |
- * | `session_start` / `session_end`   | release                  |
- * | `pre_tool_use`                    | unchanged                |
- * | `post_tool_use`                   | release                  |
- *
- * `pre_tool_use` leaves this half alone on purpose (Issue #1726). It is the
- * `AskUserQuestion` invocation, and a picker being *about to be drawn* is not
- * the kind of fact this state can carry: nothing marks the picker as answered
- * (§5.6 measured total silence through the selection and confirmation screens),
- * so an open record from this source would keep asserting `waiting` for up to
- * {@link STRUCTURED_STATE_MAX_AGE_MS} after a human answered in the terminal.
- * Whether that screen is up stays the scraper's question; what Issue #1726 adds
- * is the *content* of the question, kept in a separate record that decides no
- * status. The `PermissionRequest` `AskUserQuestion` also raises still opens a
- * provisional record here, exactly as it did in #1725 — unchanged.
- *
- * The release set is the one the spike could actually justify. `Stop` is
- * *measured*: answering an `AskUserQuestion` resumed the turn and delivered a
- * `Stop` (§5.6, received 23 → 24). `PostToolUse` — which Issue #1725's text
- * proposed — was **not** observed at all in the spike, so it is not wired up
- * here; the route does not even map it to a lifecycle event.
- * `user_prompt_submit` is release by construction: a prompt was typed at the
- * composer, so no dialog was in front of it. `session_start` / `session_end`
- * are generation changes, and a dialog does not survive one.
- *
- * `idle_prompt` releases for the same reason it maps to `ready`: the agent
- * reporting it is sitting at the composer waiting for input is the agent saying
- * nothing is in front of that composer.
- *
- * What is deliberately absent is a timer that closes it. There is no event for
- * "the human answered the dialog" — Claude emits none (§5.6) — so the other
- * half of the release rule lives in `current-output-builder`, where the scraper
- * can be asked whether the frame it saw a moment ago is still blocking.
- */
-function applyPromptWaitingTransition(key, record) {
+ * The turn transition: what one delivery does to {@link TurnRecord}
+ * (Issue #1930, §4 D3 決定 2).
+ *
+ * | event                              | turn                    | dialog   | display |
+ * |------------------------------------|-------------------------|----------|---------|
+ * | `user_prompt_submit`               | **opens a new one**     | release  | yes     |
+ * | `pre_tool_use`                     | continues, else opens   | unchanged| yes     |
+ * | `post_tool_use`                    | continues, else opens   | release  | yes     |
+ * | `stop` (this session)              | **closes** `stop`       | release  | yes     |
+ * | `stop` (another session)           | unchanged               | unchanged| no      |
+ * | `session_end`                      | **closes** `session_end`| release  | no      |
+ * | `session_start`                    | new generation (above)  | evicted  | no      |
+ * | `notification(permission_prompt)`  | unchanged               | **open** | only to bootstrap |
+ * | `notification(permission_replied)` | unchanged               | release  | no      |
+ * | `notification(idle_prompt)`        | unchanged               | release  | yes     |
+ * | `notification(anything else)`      | unchanged               | unchanged| no      |
+ *
+ * Four rows are the whole point of the Issue, and each of them was a defect
+ * under "the newest event is the verdict":
+ *
+ *  - **`user_prompt_submit` opens a new turn, the tool-call events continue the
+ *    open one.** That is what makes {@link TurnRecord.turnId} an identity: #1926
+ *    re-stamped it on every `pre_tool_use`, so a consumer reading a changed id
+ *    as "a new turn began" false-positived several times inside one turn. `wait`
+ *    reads it that way now.
+ *  - **A `stop` naming another session changes nothing.** opencode publishes
+ *    `session.idle` for every session its server holds, other processes'
+ *    included (#1758 §5.6).
+ *  - **`session_start` / `session_end` / an unknown notification /
+ *    `permission_replied` do not become the displayed event.** An event carrying
+ *    no verdict must not erase one. #1903 fixed the single measured instance
+ *    (copilot's late `SessionStart`) by holding the delivery; the rule is
+ *    general here, and the capability it reads is still the only reason a
+ *    `session_start` is held rather than recorded.
+ *  - **`notification(permission_prompt)` does not become the displayed event
+ *    when a turn already exists.** The dialog is a fact about the *pane*, and
+ *    it is published by the decision ledger below. Letting it overwrite the
+ *    display is how the pre-#1898 `waiting` outlived the approval that caused
+ *    it: released, the record still said `waiting`, because the only thing it
+ *    could read was the event that opened the dialog.
+ *
+ * `idle_prompt` is the one row that publishes `ready` **without** closing the
+ * turn, and that is a measurement rather than an oversight: #1839 caught Claude
+ * emitting it 62 s into a turn that ran nothing, so it cannot be a turn
+ * boundary. `wait`'s gate stays armed through it; what changes is only what the
+ * pane displays.
+ */
+function applyTurnTransition(key, record) {
+    const generation = currentGeneration(key);
+    // An event stamped before the current generation was produced by a process
+    // that has been replaced. Refusing it here is what makes re-recording a stale
+    // `user_prompt_submit` at its original timestamp a no-op.
+    if (generation !== null && record.at < generation)
+        return;
     switch (record.event) {
-        case 'notification':
-            if (record.detail === 'permission_prompt') {
-                openPromptWaiting(key, {
-                    source: 'notification',
-                    message: record.message ?? null,
-                    at: record.at,
-                });
-            }
-            else if (record.detail === 'idle_prompt') {
-                promptWaiting.delete(key);
-            }
-            return;
-        case 'stop':
         case 'user_prompt_submit':
-        case 'session_start':
-        case 'session_end':
-            promptWaiting.delete(key);
+            openTurn(key, record, generation, { continueOpen: false });
+            releaseAllDecisions(key);
             return;
         case 'post_tool_use':
+            openTurn(key, record, generation, { continueOpen: true });
             // The tool call the dialog was gating has finished, so somebody answered
             // it (Issue #1726). This is the release #1725 could not have: it had no
             // event meaning "the human answered", only `Stop` meaning "the turn
             // ended", which can be minutes later.
-            promptWaiting.delete(key);
+            releaseAllDecisions(key);
             return;
         case 'pre_tool_use':
+            // Deliberately leaves the dialog alone (Issue #1726). It is the
+            // `AskUserQuestion` invocation, and a picker being *about to be drawn* is
+            // not a fact this state can carry.
+            openTurn(key, record, generation, { continueOpen: true });
+            return;
+        case 'stop':
+            applyStopToTurn(key, record, generation);
+            return;
+        case 'session_end':
+            applySessionEndToTurn(key, record);
+            releaseAllDecisions(key);
+            return;
+        case 'session_start':
+            // The generation was opened by `recordAgentEvent` before this ran, and
+            // `fenceTurnForNewGeneration` closed the turn with it. Nothing further:
+            // the frame carries no verdict, so it is not the displayed event either.
+            return;
+        case 'notification':
+            applyNotificationToTurn(key, record, generation);
             return;
         default:
             // exhaustive check: a new AgentEventType must decide its transition here
@@ -356,6 +752,304 @@ function applyPromptWaitingTransition(key, record) {
             return;
     }
 }
+/** The three fields the turn keeps from a record. */
+function displayOf(record) {
+    return { event: record.event, at: record.at, detail: record.detail };
+}
+/**
+ * Open a turn for this event, or move the display onto an open one.
+ *
+ * @param continueOpen - Whether an already-open turn of the same session is
+ *   this event's turn. False for `user_prompt_submit`, which IS a new turn.
+ */
+function openTurn(key, record, generation, { continueOpen }) {
+    const turn = fencedTurn(key);
+    const openHere = turn !== null &&
+        turn.closedAt === null &&
+        turn.openedAt !== null &&
+        (0, provisional_turn_1.closesTurn)(turn, record.sessionId);
+    if (continueOpen && openHere) {
+        turn.displayEvent = displayOf(record);
+        // A hand-configured relay posts no session id, so a turn can learn one
+        // partway through. Learning it is what lets a later `stop` be matched.
+        turn.sessionId ??= record.sessionId;
+        turn.scraperCompletionPolls = 0;
+        return;
+    }
+    // A dialog-only record (openedAt null) is not a turn; its decisions belong to
+    // the turn that is opening now, because that is when they were raised.
+    const carried = turn !== null && turn.openedAt === null && turn.closedAt === null
+        ? turn.pendingDecisions
+        : [];
+    agentTurns.set(key, {
+        turnId: nextTurnId(record.at),
+        sessionId: record.sessionId,
+        openedAt: record.at,
+        closedAt: null,
+        closedBy: null,
+        generationAt: generation,
+        displayEvent: displayOf(record),
+        pendingDecisions: carried,
+        scraperCompletionPolls: 0,
+    });
+    boundTurnMap();
+}
+/**
+ * Apply a `stop` — the only event that is the agent saying its turn is over.
+ *
+ * A `stop` for another session leaves everything alone; see {@link closesTurn}.
+ * A `stop` with no turn open still records one, because "this instance last
+ * reported it stopped at T" is the fact `ready` is published from, and the
+ * opening it never saw is published as null rather than guessed.
+ */
+function applyStopToTurn(key, record, generation) {
+    const turn = fencedTurn(key);
+    if (turn !== null && turn.closedAt === null && turn.openedAt !== null) {
+        if (!(0, provisional_turn_1.closesTurn)(turn, record.sessionId))
+            return;
+        turn.closedAt = record.at;
+        turn.closedBy = 'stop';
+        turn.displayEvent = displayOf(record);
+        releaseAllDecisions(key);
+        return;
+    }
+    agentTurns.set(key, {
+        turnId: nextTurnId(record.at),
+        sessionId: record.sessionId,
+        openedAt: null,
+        closedAt: record.at,
+        closedBy: 'stop',
+        generationAt: generation,
+        displayEvent: displayOf(record),
+        pendingDecisions: [],
+        scraperCompletionPolls: 0,
+    });
+    boundTurnMap();
+}
+/**
+ * `session_end`: the agent session this instance was talking to is gone.
+ *
+ * **Overwrites an existing close reason**, which is the one place in this
+ * module where a later event rewrites an earlier verdict, and #1723's contract
+ * is why. `/clear` emits `SessionEnd(reason=clear)` on a session that is alive
+ * and about to keep going, and the turn before it may perfectly well have ended
+ * with a `Stop`. Leaving that `Stop` standing would keep publishing "the agent
+ * finished" about a conversation that no longer exists — the integration pin is
+ * `current-output-structured-status-1723`, which asserts the session goes back
+ * to the scraper the moment `SessionEnd` lands.
+ *
+ * `closedBy: 'session_end'` publishes no verdict of its own (see
+ * {@link getStructuredSessionState}), so this is a retirement rather than a
+ * different answer.
+ */
+function applySessionEndToTurn(key, record) {
+    const turn = fencedTurn(key);
+    if (turn === null)
+        return;
+    if (!(0, provisional_turn_1.closesTurn)(turn, record.sessionId))
+        return;
+    turn.closedAt = record.at;
+    turn.closedBy = 'session_end';
+}
+/**
+ * The notification rows of the transition table.
+ *
+ * Matched on `notification_type` ({@link AgentEventRecord.detail}), never on the
+ * human-facing `message` (D3): the observed messages are English prose the agent
+ * is free to reword.
+ */
+function applyNotificationToTurn(key, record, generation) {
+    if (record.detail === 'permission_prompt') {
+        if (record.promptSettled === true) {
+            // Issue #1898: adjudicated before it was recorded, and the verdict
+            // reached the agent. There is no dialog and there never was one for a
+            // human to answer — opening a record for it published `waiting` for the
+            // whole of the tool call that followed (measured at eight seconds).
+            releaseSettledDecision(key, record);
+            return;
+        }
+        openDecision(key, generation, {
+            source: 'notification',
+            at: record.at,
+            message: record.message ?? null,
+            toolName: null,
+            decisionId: record.decisionId ?? null,
+            bootstrapDisplay: displayOf(record),
+        });
+        return;
+    }
+    if (record.detail === agent_event_types_1.PERMISSION_REPLIED_DETAIL) {
+        // Issue #1898. The agent's own statement that the dialog is gone — whoever
+        // answered it. Not a word this build reads a status from, so it decides
+        // nothing; all it does is retire the record.
+        if (record.promptSettled === true)
+            releaseSettledDecision(key, record);
+        return;
+    }
+    if (record.detail === 'idle_prompt') {
+        // The agent reporting it is sitting at the composer waiting for input is the
+        // agent saying nothing is in front of that composer.
+        releaseAllDecisions(key);
+        const turn = fencedTurn(key);
+        if (turn !== null && turn.closedAt === null) {
+            turn.displayEvent = displayOf(record);
+            return;
+        }
+        if (turn !== null)
+            return;
+        // Nothing to attach it to — the first thing this instance ever said, or the
+        // first since a generation. It still carries a verdict (`ready`), and #1723
+        // publishes it, so a display-only record is opened to hold it. `openedAt`
+        // stays null: an agent sitting at its composer is not in a turn, and a
+        // record that claimed otherwise would gate `wait` on a turn nobody opened.
+        agentTurns.set(key, {
+            turnId: nextTurnId(record.at),
+            sessionId: record.sessionId,
+            openedAt: null,
+            closedAt: null,
+            closedBy: null,
+            generationAt: generation,
+            displayEvent: displayOf(record),
+            pendingDecisions: [],
+            scraperCompletionPolls: 0,
+        });
+        boundTurnMap();
+        return;
+    }
+    // An unrecognised notification type is not evidence of anything, and guessing
+    // would be worse than the scraper.
+}
+/**
+ * Open, or refresh, a dialog record on this instance's turn.
+ *
+ * `bootstrapDisplay` is used only when there is no record at all to hang the
+ * decision on. That record is deliberately **not** an open turn — its
+ * `openedAt` is null — so releasing the decision hands the pane back to the
+ * scraper rather than asserting `running` for a turn nobody ever saw open.
+ */
+function openDecision(key, generation, input) {
+    let turn = fencedTurn(key);
+    if (turn === null) {
+        turn = {
+            turnId: nextTurnId(input.at),
+            sessionId: null,
+            openedAt: null,
+            closedAt: null,
+            closedBy: null,
+            generationAt: generation,
+            displayEvent: input.bootstrapDisplay,
+            pendingDecisions: [],
+            scraperCompletionPolls: 0,
+        };
+        agentTurns.set(key, turn);
+        boundTurnMap();
+    }
+    else if (turn.closedAt !== null) {
+        // The dialog is being raised after the turn it would have belonged to
+        // ended — a `PermissionRequest` racing a `Stop`, or a re-check landing
+        // late. Re-open a dialog-only record rather than resurrecting the turn.
+        turn = {
+            turnId: nextTurnId(input.at),
+            sessionId: null,
+            openedAt: null,
+            closedAt: null,
+            closedBy: null,
+            generationAt: generation,
+            displayEvent: input.bootstrapDisplay,
+            pendingDecisions: [],
+            scraperCompletionPolls: 0,
+        };
+        agentTurns.set(key, turn);
+        boundTurnMap();
+    }
+    // Issue #1930 / S1: an id that fails validation is DISCARDED, not truncated —
+    // a truncated id compares equal to a different id sharing its prefix, and the
+    // reply to one approval would then retire another's record.
+    const decisionId = input.decisionId === null ? null : (0, provisional_turn_1.acceptExternalId)(input.decisionId);
+    if (input.decisionId !== null && decisionId === null)
+        dropsFor(key).idsDiscarded += 1;
+    const confirmed = input.source === 'notification';
+    // Which record, if any, this report is a second sighting of.
+    //
+    //  - an id matches its own record;
+    //  - an id with no record of its own may still be *confirming* the anonymous
+    //    prediction that forecast it. That is the measured pair: a
+    //    `PermissionRequest` this server declined to decide fires ~6 s before the
+    //    `Notification(permission_prompt)` that proves the dialog, and the
+    //    request carries no id;
+    //  - an anonymous report merges only with another anonymous one. A source
+    //    that publishes no ids therefore keeps exactly one dialog record per
+    //    instance, which is what #1725 did and the honest limit for it — matching
+    //    an anonymous report against an *identified* record would let one
+    //    approval's forecast confirm a different approval's dialog.
+    const existing = decisionId !== null
+        ? (turn.pendingDecisions.find((decision) => decision.decisionId === decisionId) ??
+            turn.pendingDecisions.find((decision) => decision.decisionId === null && decision.source === 'permission-request'))
+        : turn.pendingDecisions.find((decision) => decision.decisionId === null);
+    if (existing) {
+        // The same dialog, reported twice: `PermissionRequest` predicted it and the
+        // `Notification` then proved it. Keep the earliest `at` — that is when the
+        // human was first blocked, and it is what the scraper-release grace and the
+        // age bound are measured from — and take the confirmation.
+        existing.message = (0, provisional_turn_1.boundDecisionMessage)(input.message) ?? existing.message;
+        existing.toolName = (0, provisional_turn_1.boundDecisionToolName)(input.toolName) ?? existing.toolName;
+        existing.decisionId ??= decisionId;
+        if (confirmed) {
+            existing.source = 'notification';
+            existing.confirmedAt ??= input.at;
+        }
+        return;
+    }
+    if (turn.pendingDecisions.length >= provisional_turn_1.MAX_PENDING_DECISIONS_PER_TURN) {
+        // S14(d). Counted rather than dropped in silence: an agent raising more
+        // approvals than this in one turn is a fact an operator has to be able to
+        // see, and the oldest is the one a human has been looking at.
+        dropsFor(key).decisionOverflow += 1;
+        return;
+    }
+    turn.pendingDecisions.push({
+        decisionId,
+        at: input.at,
+        source: input.source,
+        message: (0, provisional_turn_1.boundDecisionMessage)(input.message),
+        toolName: (0, provisional_turn_1.boundDecisionToolName)(input.toolName),
+        confirmedAt: confirmed ? input.at : null,
+        scraperCorroborated: false,
+        recorded: false,
+    });
+}
+/** Retire every dialog this instance was holding. */
+function releaseAllDecisions(key) {
+    const turn = fencedTurn(key);
+    if (turn !== null)
+        turn.pendingDecisions = [];
+}
+/**
+ * Retire the record a verdict was delivered for (Issue #1898).
+ *
+ * Matched on {@link AgentEventRecord.decisionId} when both sides have one: an
+ * agent that can run two approvals at once would otherwise have the reply to
+ * the first retire the record for the second. When either side is anonymous the
+ * release is unconditional — an unmatched id is a source that publishes none,
+ * and refusing to act there would leave the pre-#1898 stall in place for it.
+ */
+function releaseSettledDecision(key, record) {
+    const turn = fencedTurn(key);
+    if (turn === null || turn.pendingDecisions.length === 0)
+        return;
+    const settledId = record.decisionId === null || record.decisionId === undefined
+        ? null
+        : (0, provisional_turn_1.acceptExternalId)(record.decisionId);
+    if (settledId === null) {
+        turn.pendingDecisions = [];
+        return;
+    }
+    turn.pendingDecisions = turn.pendingDecisions.filter((decision) => decision.decisionId !== null && decision.decisionId !== settledId);
+}
+/** Keep the turn map bounded the way every other map in this module is. */
+function boundTurnMap() {
+    trimOldestEntries(agentTurns, MAX_RECENT_EVENT_KEYS);
+}
 /**
  * @returns The last structured event reported by this instance, or null when it
  *   has reported none.
@@ -456,22 +1150,15 @@ function getLastKnownAgentEffort(worktreeId, cliToolId, instanceId) {
 }
 /**
  * How long a structured verdict is trusted after the event that produced it
- * (Issue #1723).
+ * (Issue #1723; one expression since #1930).
  *
- * Hooks are fail-open by design: a timeout or a refused connection costs the
- * event and never the agent's turn (`agent-hooks-live-verification.md` §1.1).
- * A *lost* `Stop` is therefore possible, and without a bound it would leave
- * this layer asserting `running` for a session that finished — `commandmate
- * wait` would then poll until `--timeout` on a session the scraper could have
- * called done. The bound converts "forever" into "at most this long", after
- * which the scraper takes the session back.
- *
- * Deliberately generous. A single agent turn running past 30 minutes is
- * ordinary for the workloads this tool exists to babysit, and expiring a live
- * verdict mid-turn costs the whole benefit of the two-layer split. Expiry is
- * not a failure mode: it is exactly the pre-#1723 behaviour.
+ * The turn model owns the number now — see `provisional-turn`'s
+ * {@link TURN_STALE_AFTER_MS}, which documents why it is 30 minutes. This name
+ * is kept because it is what `status-evidence` and the #1723/#1725/#1903 suites
+ * read, and because "the age bound on a verdict" and "how long a turn may run
+ * unheard-from" really are the same fact rather than two that happen to agree.
  */
-exports.STRUCTURED_STATE_MAX_AGE_MS = 30 * 60 * 1000;
+exports.STRUCTURED_STATE_MAX_AGE_MS = provisional_turn_1.TURN_STALE_AFTER_MS;
 /**
  * Open a new generation for this instance, invalidating everything reported
  * before now (Issue #1723).
@@ -492,11 +1179,13 @@ exports.STRUCTURED_STATE_MAX_AGE_MS = 30 * 60 * 1000;
 function beginAgentEventGeneration(worktreeId, cliToolId, instanceId, at = Date.now()) {
     const key = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
     generationStartedAt.set(key, at);
-    // A dialog belongs to the process that drew it (Issue #1725). The generation
-    // bound in `getStructuredPromptWaiting` would already hide it, but leaving the
-    // record behind means a later `corroborate`/`markRecorded` would mutate a
-    // dead episode.
-    promptWaiting.delete(key);
+    // Issue #1930: the turn the previous process was in ends with that process,
+    // and the approvals it was holding go with it — they were raised against a
+    // slot nobody is holding open any more. The turn record is kept, closed as
+    // `closedBy: 'generation'`, so `capture --json` can say why it ended instead
+    // of going quiet. The dialogs #1725 kept in a map of their own live on that
+    // record now, which is what makes this one call retire both.
+    fenceTurnForNewGeneration(key, at);
     // Same reasoning for the question that dialog was asking (Issue #1726).
     askUserQuestion.delete(key);
     // And for "waiting for your input" (Issue #1786): a new process has not asked
@@ -514,6 +1203,10 @@ function beginAgentEventGeneration(worktreeId, cliToolId, instanceId, at = Date.
     // a relaunch would show the old process's effort with no frame left that
     // could contradict it. The next poll re-reads a live footer immediately.
     capturedModelInfo.delete(key);
+    // Issue #1899: the ids claimed for this key were issued by the process that
+    // has just been replaced. Unlike the time-window keys, they never expire on
+    // their own, so a generation is the only thing that retires them.
+    recentEventIdentities.delete(key);
 }
 /**
  * @returns Epoch ms the current generation began, or null when no generation
@@ -536,143 +1229,153 @@ function discardAgentEventState(worktreeId, cliToolId, instanceId) {
     const key = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
     lastAgentEvent.delete(key);
     generationStartedAt.delete(key);
-    promptWaiting.delete(key);
+    // Issue #1930: the turn, and with it the dialogs it was holding. Not counted
+    // as an eviction — the session is gone, so there is nobody left to tell.
+    agentTurns.delete(key);
+    dropCounts.delete(key);
     askUserQuestion.delete(key);
     awaitingInstruction.delete(key);
     // Issue #1783: the session that was on this model no longer exists.
     lastAgentModel.delete(key);
     // Issue #1784: nor does the pane its footer was read from.
     capturedModelInfo.delete(key);
+    // Issue #1899: nor do the frame ids that session issued.
+    recentEventIdentities.delete(key);
 }
 /**
- * The status this instance's structured events imply, or null when they imply
- * nothing (Issue #1723).
+ * The status this instance's turn implies, or null when it implies nothing
+ * (Issue #1723, re-derived from the turn model in #1930).
  *
  * Null is the answer for every session on a machine where hooks never fire,
  * which is what keeps the unconfigured environment on exactly the behaviour it
- * had before this Issue. It is also the answer when:
- *
- *  - the last event carries no verdict (`session_start`, `session_end`, a
- *    `Notification` of an unrecognised type) — see `agentEventToSessionStatus`;
- *  - the event predates the current generation, i.e. it belongs to a previous
- *    Claude process in a reused pane;
- *  - the event is older than {@link STRUCTURED_STATE_MAX_AGE_MS}.
+ * had before #1723. It is also the answer when:
+ *
+ *  - the turn belongs to a previous generation, i.e. to an agent process that
+ *    used to live in this pane;
+ *  - nothing has been heard about it for {@link STRUCTURED_STATE_MAX_AGE_MS};
+ *  - the turn ended for a reason that says nothing about whether the pane is
+ *    free — `session_end` (a `/clear` mid-turn), `stale`, `generation`, or the
+ *    two the *screen* closed it on (`scraper_evidence`, `resync_idle`). Only
+ *    the agent's own `Stop` publishes `ready` over this channel; everything
+ *    else hands the pane back to the scraper, which is the layer those closures
+ *    came from in the first place;
+ *  - no decision stands and the displayed event carries no verdict.
+ *
+ * ## The derivation, in the order it is applied
+ *
+ * | condition                                   | verdict                       |
+ * |---------------------------------------------|-------------------------------|
+ * | an unanswered decision is live              | `waiting`                     |
+ * | the turn was closed by `stop`               | `ready` / `hook_stop`         |
+ * | the turn was closed by anything else        | null                          |
+ * | the displayed event carries a verdict       | that verdict                  |
+ * | a turn is open and it does not              | `running` / `hook_prompt_submit` |
+ * | otherwise                                   | null                          |
+ *
+ * §4 D3's `running ⟺ open turn ∧ 未裁定なし ∧ 現世代` falls out of the first,
+ * fourth and fifth rows together with the generation fence — with one measured
+ * exception written into the table above it: `notification(idle_prompt)`
+ * publishes `ready` **without** closing the turn (#1839 caught Claude emitting
+ * it 62 s into a turn that ran nothing, so it cannot be a boundary). A reader
+ * that needs the boundary rather than the display reads `closedAt`.
  *
  * Whether the tmux session is alive is NOT checked here — the caller
- * (`buildCurrentOutput`) has already answered that question with the CLI tool's
- * own `isRunning()` and returned early, and asking twice would mean a second
- * tmux round-trip on the hot path for an answer it is holding.
+ * (`buildCurrentOutput`) has already answered that with the CLI tool's own
+ * `isRunning()` and returned early, and asking twice would mean a second tmux
+ * round-trip on the hot path for an answer it is holding.
  *
  * @param now - Epoch ms; defaults to now
  */
 function getStructuredSessionState(worktreeId, cliToolId, instanceId, now = Date.now()) {
     const key = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
-    const record = lastAgentEvent.get(key);
-    if (!record)
+    const turn = effectiveTurn(key, now);
+    if (turn === null)
         return null;
-    const generation = generationStartedAt.get(key);
-    if (generation !== undefined && record.at < generation)
+    const display = turn.displayEvent;
+    if (now - display.at >= exports.STRUCTURED_STATE_MAX_AGE_MS)
         return null;
-    if (now - record.at >= exports.STRUCTURED_STATE_MAX_AGE_MS)
-        return null;
-    const verdict = (0, status_mapping_1.agentEventToSessionStatus)(record.event, record.detail);
-    if (verdict === null)
+    const seen = { event: display.event, at: display.at, detail: display.detail };
+    const pending = livePendingDecisions(key, turn, now);
+    if (pending.length > 0) {
+        // The two kinds of evidence stay apart in the reason token, exactly as
+        // `structuredWaitingReason` keeps them apart for the payload: a
+        // `Notification` is proof a dialog exists, a `PermissionRequest` this
+        // server declined to decide is the prediction that one is about to.
+        const reason = pending[0].source === 'notification'
+            ? status_mapping_1.HOOK_STATUS_REASON.PERMISSION_PROMPT
+            : status_mapping_1.HOOK_STATUS_REASON.PERMISSION_REQUEST;
+        return { status: 'waiting', reason, ...seen };
+    }
+    if (turn.closedAt !== null) {
+        if (turn.closedBy === 'stop') {
+            return { status: 'ready', reason: status_mapping_1.HOOK_STATUS_REASON.STOP, ...seen };
+        }
         return null;
-    return { ...verdict, event: record.event, at: record.at, detail: record.detail };
+    }
+    const verdict = (0, status_mapping_1.agentEventToSessionStatus)(display.event, display.detail);
+    // A `waiting` read off the displayed event is a dialog nothing is holding any
+    // more — the ledger above is what answers that question now. The turn is
+    // still open, so the agent is still working.
+    if (verdict === null || verdict.status === 'waiting') {
+        if (turn.openedAt === null)
+            return null;
+        return { status: 'running', reason: status_mapping_1.HOOK_STATUS_REASON.PROMPT_SUBMIT, ...seen };
+    }
+    return { ...verdict, ...seen };
 }
 /**
  * How long a `permission-request`-sourced record survives without
- * corroboration (Issue #1725).
- *
- * The two sources differ in kind. `Notification(permission_prompt)` fires ~6 s
- * *after* the dialog is drawn and only when one is (§5.5): its arrival is proof.
- * A no-decision `PermissionRequest` fires *before* the dialog, so it is a
- * prediction — an accurate one (D5 measured `{}` landing in the ordinary TUI
- * approval flow), but a prediction about a version of Claude, a permission mode
- * and a rule set this server does not get to see in full.
- *
- * A prediction that nothing confirms must expire, because the cost of it
- * sticking is a `wait --on-prompt agent` that exits 10 on a session with no
- * dialog in it — a worker aborted for nothing. 20 s is generous against both
- * confirmations: the `Notification` lands at ~6 s, and the scraper reads the
- * pane through a 5 s capture cache on a 5 s poll. Expiring is not a failure
- * mode; it is the pre-#1725 behaviour for a dialog neither layer ever saw.
- */
-exports.STRUCTURED_PROMPT_PROVISIONAL_MAX_AGE_MS = 20_000;
-/** Open, or refresh, the prompt-waiting record for one instance. */
-function openPromptWaiting(key, input) {
-    const existing = promptWaiting.get(key);
-    const confirmed = input.source === 'notification';
-    if (existing) {
-        // The same dialog, reported twice: `PermissionRequest` predicted it and the
-        // `Notification` then proved it. Keep the earliest `at` — that is when the
-        // human was first blocked, and it is what the scraper-release grace and the
-        // age bound are measured from — and take the confirmation.
-        existing.message = input.message ?? existing.message;
-        existing.toolName = input.toolName ?? existing.toolName;
-        if (confirmed) {
-            existing.source = 'notification';
-            existing.confirmedAt ??= input.at;
-        }
-        return;
-    }
-    promptWaiting.set(key, {
-        at: input.at,
-        source: input.source,
-        message: input.message
-            ? input.message.slice(0, structured_prompt_1.MAX_STRUCTURED_PROMPT_MESSAGE_LENGTH)
-            : null,
-        toolName: input.toolName ?? null,
-        confirmedAt: confirmed ? input.at : null,
-        scraperCorroborated: false,
-        recorded: false,
-    });
-}
+ * corroboration (Issue #1725; one expression since #1930).
+ *
+ * The turn model owns the number — see `provisional-turn`'s
+ * {@link DIALOG_PENDING_MAX_MS}, whose doc has the measurement. Kept under this
+ * name for `permission-decision-service`, which cites it, and for the #1725
+ * suite.
+ */
+exports.STRUCTURED_PROMPT_PROVISIONAL_MAX_AGE_MS = provisional_turn_1.DIALOG_PENDING_MAX_MS.predicted;
 /**
  * Report that a dialog is open because the agent asked us to adjudicate one and
  * we declined to (Issue #1725, Auto-Yes v2's no-decision path).
  *
  * Provisional: see {@link STRUCTURED_PROMPT_PROVISIONAL_MAX_AGE_MS}.
  *
+ * Called by `permission-decision-service` and by opencode's ingest, both of
+ * which have already applied the `permissionHookPredictsDialog` capability gate
+ * (#1901) — this function is told, it does not decide.
+ *
  * @param at - Epoch ms; defaults to now
  */
 function reportPermissionRequestPending(worktreeId, cliToolId, instanceId, toolName, at = Date.now()) {
-    openPromptWaiting((0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId), {
+    const key = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
+    openDecision(key, currentGeneration(key), {
         source: 'permission-request',
+        at,
         message: null,
         toolName,
-        at,
+        decisionId: null,
+        // A forecast carries no event of its own, so the record it bootstraps is
+        // described by the thing it is forecasting. `structuredEvents.lastEventType`
+        // is unaffected — that reads `getLastAgentEvent`, which nothing here writes.
+        bootstrapDisplay: { event: 'notification', at, detail: 'permission_prompt' },
     });
 }
 /**
  * The open dialog this instance's structured events imply, or null.
  *
  * Bounded exactly like {@link getStructuredSessionState}: a record from a
- * previous generation is not this session's, and one older than
- * {@link STRUCTURED_STATE_MAX_AGE_MS} has outlived the fact it describes. An
- * unconfirmed `permission-request` record expires far sooner — see
- * {@link STRUCTURED_PROMPT_PROVISIONAL_MAX_AGE_MS}.
+ * previous generation is not this session's, and one past its retention bound
+ * has outlived the fact it describes. An unconfirmed `permission-request`
+ * record expires far sooner — see {@link DIALOG_PENDING_MAX_MS}.
  *
- * The returned object is the live record, not a copy: `current-output-builder`
- * marks corroboration and the history write on it.
+ * The oldest live decision, because that is the one a human has been looking
+ * at, and because it is the record #1725 published when there could only ever
+ * be one. The returned object is the live record, not a copy:
+ * `prompt-waiting-composition` marks corroboration and the history write on it.
  *
  * @param now - Epoch ms; defaults to now
  */
 function getStructuredPromptWaiting(worktreeId, cliToolId, instanceId, now = Date.now()) {
-    const key = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
-    const state = promptWaiting.get(key);
-    if (!state)
-        return null;
-    const generation = generationStartedAt.get(key);
-    if (generation !== undefined && state.at < generation)
-        return null;
-    if (now - state.at >= exports.STRUCTURED_STATE_MAX_AGE_MS)
-        return null;
-    if (state.confirmedAt === null &&
-        now - state.at >= exports.STRUCTURED_PROMPT_PROVISIONAL_MAX_AGE_MS) {
-        return null;
-    }
-    return state;
+    return getPendingDecisions(worktreeId, cliToolId, instanceId, now)[0] ?? null;
 }
 /**
  * Record that the scraper has seen a blocking frame while this dialog is open
@@ -680,12 +1383,12 @@ function getStructuredPromptWaiting(worktreeId, cliToolId, instanceId, now = Dat
  *
  * Two effects, both needed: it confirms a provisional record, and it arms the
  * only release rule the scraper is entitled to apply. See
- * {@link StructuredPromptWaitingState.scraperCorroborated}.
+ * {@link StructuredPendingDecision.scraperCorroborated}.
  *
  * @param at - Epoch ms; defaults to now
  */
 function corroborateStructuredPromptWaiting(worktreeId, cliToolId, instanceId, at = Date.now()) {
-    const state = promptWaiting.get((0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId));
+    const state = getStructuredPromptWaiting(worktreeId, cliToolId, instanceId, at);
     if (!state)
         return;
     state.scraperCorroborated = true;
@@ -693,18 +1396,23 @@ function corroborateStructuredPromptWaiting(worktreeId, cliToolId, instanceId, a
 }
 /** Note that this episode's prompt-history row has been written. */
 function markStructuredPromptRecorded(worktreeId, cliToolId, instanceId) {
-    const state = promptWaiting.get((0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId));
+    const state = getStructuredPromptWaiting(worktreeId, cliToolId, instanceId);
     if (state)
         state.recorded = true;
 }
 /**
  * Release the prompt-waiting record — the dialog is gone (Issue #1725).
  *
- * Called from the event transitions above and from `current-output-builder`
+ * Called from the turn transition above and from `prompt-waiting-composition`
  * when the scraper reports that the frame it corroborated has cleared.
+ *
+ * Releases every decision this instance is holding, not only the first. The
+ * scraper's statement is about the *pane*, and a pane with no dialog on it has
+ * no dialogs on it — retiring one and leaving the rest would publish `waiting`
+ * for a frame the scraper has just said is clear.
  */
 function clearStructuredPromptWaiting(worktreeId, cliToolId, instanceId) {
-    promptWaiting.delete((0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId));
+    releaseAllDecisions((0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId));
 }
 /**
  * When the in-flight question is released (Issue #1726).
@@ -889,13 +1597,154 @@ function pruneRecentEventKeys(now) {
 function getRecentEventKeyCount() {
     return recentEventKeys.size;
 }
+// =============================================================================
+// Identity de-duplication (Issue #1899)
+// =============================================================================
+/**
+ * Event words whose repeat is a fact about the session, not a re-delivery
+ * (Issue #1899; design §4 D3 decision 2).
+ *
+ * These are the two words that end something, and neither of them carries an
+ * id on any source measured so far. `session.idle` — opencode's `stop` — is
+ * `{ "sessionID": "ses_…" }` and nothing else, which is exactly why
+ * `sources/opencode/turn-gate` exists. With no id, a generic deduper has only
+ * the clock, and the clock cannot tell a second turn from a second delivery:
+ * #1899 measured a real `stop` 2.5 s after the previous one being dropped,
+ * which leaves the newest event at `user_prompt_submit`, the instance reading
+ * `running`, and `commandmate wait` blocked until the 30-minute staleness
+ * bound.
+ *
+ * **The exemption is conditional on the source declaring an identity**, and
+ * that condition is the whole safety argument. A source that declares one is a
+ * source with a real deduper elsewhere — on the SSE path, `TurnGate`, which
+ * arms on `session.status(busy)` and completes on the first `session.idle`
+ * after arming, so the abort double-idle (19 ms apart, §5.3.2) never reaches
+ * the ingest at all. Push hooks have no such gate: #1722's concatenated
+ * settings really do post two `Stop`s for one turn, and
+ * {@link isDuplicateAgentEvent} — which is what every hook receiver still
+ * calls — is left untouched for them.
+ */
+exports.LIFECYCLE_AGENT_EVENT_TYPES = ['stop', 'session_end'];
+/**
+ * Whether this delivery is a second copy of one already handled (Issue #1899).
+ *
+ * The tool-agnostic replacement for calling {@link isDuplicateAgentEvent}
+ * directly, and it branches on the source's declared capability rather than on
+ * its name — flip opencode's `eventIdentity` to `null` and every case below
+ * falls back to the 3-second window it used before this Issue.
+ *
+ * Three rules, in order:
+ *
+ *  1. **The frame has an id** — key on it, with no time bound at all. An id is
+ *     a claim about identity that a clock cannot improve on: two approvals
+ *     1 s apart are two approvals, and the same approval replayed by
+ *     `resyncPending` four minutes later is still one approval. That second
+ *     half is what the ingest's window was reaching for ("a frame delivered
+ *     twice by a re-sync racing the live stream") and never actually covered,
+ *     since a re-sync is not obliged to land within three seconds.
+ *  2. **No id, but the word ends something** — never suppressed. See
+ *     {@link LIFECYCLE_AGENT_EVENT_TYPES}.
+ *  3. **Anything else** — the time window, unchanged. That is every push
+ *     source, and the identity-declaring source's `session.created` /
+ *     `session.error`, which publish no id either but are not turn boundaries.
+ *
+ * Calling this *claims* the key, exactly as {@link isDuplicateAgentEvent} does:
+ * ask once per delivery and act on the answer.
+ */
+function classifyAgentEventDelivery(delivery) {
+    const composite = (0, auto_yes_state_1.buildCompositeKey)(delivery.worktreeId, delivery.cliToolId, delivery.instanceId);
+    if (delivery.identityKind !== null) {
+        // Issue #1930 / S1: the id is the agent's, and it becomes a Map key. One
+        // that fails validation is DISCARDED — the delivery then takes the
+        // no-id path below, which is a path this function already has — rather than
+        // truncated, because a truncated id compares equal to a different id that
+        // shares its prefix and would drop a real event as a repeat.
+        const identity = delivery.identity === null ? null : (0, provisional_turn_1.acceptExternalId)(delivery.identity);
+        if (delivery.identity !== null && identity === null)
+            dropsFor(composite).idsDiscarded += 1;
+        if (identity !== null) {
+            if (claimEventIdentity(delivery, identity)) {
+                dropsFor(composite).dedupDropped.identity += 1;
+                return { duplicate: true, by: 'identity' };
+            }
+            return { duplicate: false };
+        }
+        if (exports.LIFECYCLE_AGENT_EVENT_TYPES.includes(delivery.event)) {
+            return { duplicate: false };
+        }
+    }
+    const duplicate = isDuplicateAgentEvent(delivery.worktreeId, delivery.cliToolId, delivery.instanceId, delivery.event, delivery.sessionId, delivery.at, delivery.detail);
+    if (!duplicate)
+        return { duplicate: false };
+    dropsFor(composite).dedupDropped.timeWindow += 1;
+    return { duplicate: true, by: 'time-window' };
+}
+/**
+ * Claim `(event, detail, identity)` for one instance, answering whether it was
+ * already claimed.
+ *
+ * `event` and `detail` are in the key and are not decoration: opencode asks an
+ * approval under `properties.id` and answers it under `properties.requestID`
+ * with **the same `per_…` value** (#1898), so a key made of the identity alone
+ * would read `permission.replied` as a repeat of `permission.asked` and drop
+ * the one frame that releases the dialog. The same shape covers
+ * `pre_tool_use` / `post_tool_use`, which share a `callID`.
+ *
+ * `sessionId` is deliberately *not* in the key. An id is unique within the
+ * agent that issued it, and folding in a field that is null on some deliveries
+ * would let the same frame through twice.
+ */
+function claimEventIdentity(delivery, identity) {
+    const composite = (0, auto_yes_state_1.buildCompositeKey)(delivery.worktreeId, delivery.cliToolId, delivery.instanceId);
+    let claimed = recentEventIdentities.get(composite);
+    if (!claimed) {
+        claimed = new Map();
+        recentEventIdentities.set(composite, claimed);
+        // Bound the instances as well as the entries per instance: the composite
+        // key is (worktree, tool, instance) and a long-lived server accumulates
+        // worktrees (DR4-009).
+        trimOldestEntries(recentEventIdentities, MAX_RECENT_EVENT_KEYS);
+    }
+    const key = [delivery.event, delivery.detail ?? '', identity].join(' ');
+    if (claimed.has(key))
+        return true;
+    claimed.set(key, delivery.at);
+    trimOldestEntries(claimed, MAX_RECENT_EVENT_KEYS);
+    return false;
+}
+/** Drop the oldest entries until the map fits. Maps iterate in insertion order. */
+function trimOldestEntries(entries, max) {
+    while (entries.size > max) {
+        const oldest = entries.keys().next();
+        if (oldest.done)
+            break;
+        entries.delete(oldest.value);
+    }
+}
+/**
+ * How many identities are retained for one instance, or across all of them when
+ * no instance is named. Test seam for the bound above.
+ */
+function getRecentEventIdentityCount(worktreeId, cliToolId, instanceId) {
+    if (worktreeId === undefined || cliToolId === undefined) {
+        let total = 0;
+        for (const claimed of recentEventIdentities.values())
+            total += claimed.size;
+        return total;
+    }
+    return recentEventIdentities.get((0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId))?.size ?? 0;
+}
 /** Drop every recorded event. Test seam. */
 function clearAgentStopEvents() {
     lastStopEventAt.clear();
     lastAgentEvent.clear();
     recentEventKeys.clear();
+    recentEventIdentities.clear();
     generationStartedAt.clear();
-    promptWaiting.clear();
+    // Issue #1930: the turns, the dialogs they hold, and the tally of what was
+    // dropped from them.
+    agentTurns.clear();
+    dropCounts.clear();
     askUserQuestion.clear();
     awaitingInstruction.clear();
     // Issue #1783. CI runs with `fileParallelism: false`, so every suite in the