instar 1.3.61 → 1.3.63

package/dist/core/SessionManager.d.ts

@@ -6,6 +6,8 @@
  * and can be monitored/reaped by the server.
  */
 import { EventEmitter } from 'node:events';
+import { SessionLivenessOracle } from './SessionLivenessOracle.js';
+import type { ReapGuard } from './ReapGuard.js';
 /** Diagnostics for a single running session */
 export interface SessionDiagnostic {
     name: string;
@@ -59,6 +61,13 @@ export declare class SessionManager extends EventEmitter {
     private subagentChecker?;
     /** Optional callback: is this session currently in active compaction recovery? If so, skip zombie kill. */
     private activeRecoveryChecker?;
+    /** Shared stateless KEEP-guard consulted by terminateSession (§P2). */
+    private reapGuard?;
+    /** Sessions the §P5 backstop has flagged long-`indeterminate` — excluded from
+     *  the ABSOLUTE spawn cap so unverifiable panes can't lock out spawning. */
+    private longIndeterminateSessions;
+    /** Multi-machine lease/awake predicate gating autonomous reaps (§Multi-machine). */
+    private isAwakeMachine?;
     /** Optional callback: is this tmux session currently bound to a live messaging topic
      *  (Telegram/Slack/iMessage)? Returns a stable identifier (e.g. topic ID or channel ID)
      *  when bound, null otherwise. When bound, the zombie-kill threshold is extended via
@@ -100,6 +109,15 @@ export declare class SessionManager extends EventEmitter {
     /** Per-session shim directory root (one subdir per session). Used for K9 mandatory shim. */
     private shimRoot;
     constructor(config: SessionManagerConfig, state: StateManager);
+    /** Lazily-constructed tri-state liveness oracle (UNIFIED-SESSION-LIFECYCLE §P1).
+     *  Backs the boot purge and isSessionAliveAsync so a slow/unreachable tmux is
+     *  treated as `indeterminate`, never `dead`. */
+    private _livenessOracle;
+    private get livenessOracle();
+    /** Test/DI seam: inject a liveness oracle (e.g. one with a scripted exec).
+     *  Production builds the oracle lazily from config; this lets unit tests drive
+     *  the alive/dead/indeterminate verdicts deterministically. */
+    setLivenessOracle(oracle: SessionLivenessOracle): void;
     /** Effective idle-at-prompt kill threshold (config override or hardcoded default) */
     private get effectiveIdleKillMinutes();
     /** Effective idle-at-prompt kill threshold for sessions bound to a live messaging topic.
@@ -157,6 +175,41 @@ export declare class SessionManager extends EventEmitter {
      * window. Wired by CompactionSentinel at server startup.
      */
     setActiveRecoveryChecker(checker: (session: Session) => boolean): void;
+    /**
+     * Register the shared ReapGuard (UNIFIED-SESSION-LIFECYCLE §P2). Once set,
+     * every AUTONOMOUS terminate consults it: a non-null KEEP reason makes the
+     * terminate a no-op `{ terminated:false, skipped:<reason> }`. Wired in server.ts
+     * with the same signal closures that back SessionReaper, so a killer can only
+     * *request* a kill — the authority refuses to end a guarded session. Operator
+     * kills bypass the guard. Unset (tests/standalone) → no guard consult.
+     */
+    setReapGuard(guard: ReapGuard): void;
+    /**
+     * Flag/unflag a session as long-`indeterminate` (UNIFIED-SESSION-LIFECYCLE §P5).
+     * Driven by the StaleSessionBackstop. A flagged session still counts toward the
+     * soft scheduler cap, but is excluded from the ABSOLUTE `maxSessions × 3` cap so
+     * a fleet of unverifiable panes can never lock a human out of spawning.
+     */
+    markLongIndeterminate(sessionId: string, isLong: boolean): void;
+    /**
+     * Resolve tri-state liveness for many sessions from ONE tmux snapshot via the
+     * P1 oracle (UNIFIED-SESSION-LIFECYCLE §P5 backstop). `reachable` is false when
+     * the snapshot was non-authoritative (control plane unreachable) — in which
+     * case every session resolves `indeterminate`. Shares the oracle's short-TTL
+     * cache, so the backstop and boot-purge never double-probe within a tick.
+     */
+    probeLivenessBatch(tmuxSessions: string[]): Promise<{
+        reachable: boolean;
+        liveness: Map<string, 'alive' | 'dead' | 'indeterminate'>;
+    }>;
+    /**
+     * Register the multi-machine lease/awake predicate. When set and it returns
+     * false, an AUTONOMOUS terminate is a no-op `skipped:'not-lease-holder'` — only
+     * the awake/lease-holding machine may autonomously reap; a standby may detect
+     * and signal but never kill another machine's sessions. Operator kills bypass.
+     * Unset → treated as awake (single-machine default).
+     */
+    setAwakeChecker(fn: () => boolean): void;
     /**
      * Set the Prompt Gate InputDetector for prompt monitoring.
      * When set, monitorTick() will capture output and feed it to the detector.
@@ -190,20 +243,40 @@ export declare class SessionManager extends EventEmitter {
     /** True if a reap is in flight for this session. */
     isReaping(sessionId: string): boolean;
     /**
-     * Single-writer session termination (SESSION-REAPER-SPEC §3.6). Both the
-     * idle-kill path and the SessionReaper funnel through this so a session is
-     * killed at most once with exactly-once `beforeSessionKill`/`sessionComplete`
+     * Single-writer session termination — the sole ReapAuthority
+     * (UNIFIED-SESSION-LIFECYCLE §P0, building on SESSION-REAPER-SPEC §3.6). EVERY
+     * autonomous killer funnels through this so a session is killed at most once,
+     * with exactly-once `beforeSessionKill`/`sessionComplete`/`sessionReaped`
      * emission and a correct `endedReason`.
      *
-     * Compare-and-set semantics: a session that is not in a live state
-     * ('starting'/'running'), or whose termination is already in flight, is a
-     * no-op — this is what prevents the idle-kill ↔ reaper double-kill race.
+     * The authority holds the safety checks so a killer can only *request* a kill:
+     *  - CAS on live status + an in-flight guard (prevents the double-kill race).
+     *  - `protectedSessions` (never kill).
+     *  - Lease-holder gate: an AUTONOMOUS reap on a standby machine is a no-op
+     *    `skipped:'not-lease-holder'` — only the awake machine reaps.
+     *  - ReapGuard (§P2): an AUTONOMOUS reap of a session the guard says to KEEP is
+     *    a no-op `skipped:<keep-reason>` — even a buggy killer cannot end a guarded
+     *    session.
+     * `origin:'operator'` bypasses the lease-gate and the guard (an explicit human
+     * kill must always happen). Default `origin` is `'autonomous'` so an in-process
+     * caller can never accidentally mint operator privilege.
+     *
+     * Re-entrancy: the guard is consulted BEFORE this call acquires its own
+     * in-flight lock, so the authority's lock for the kill it is performing is
+     * never misread by the guard.
+     *
+     * `disposition:'recovery-bounce'` marks a kill-to-respawn (SessionRecovery,
+     * version-skew, context-exhaustion) so the §P3 notifier stays silent — that is
+     * a bounce, not a disappearance. Default `'terminal'`.
      *
      * @returns `{ terminated: true }` on a kill performed by THIS call, or
      *          `{ terminated: false, skipped }` describing why it was a no-op.
      */
     terminateSession(sessionId: string, reason: string, opts?: {
         finalStatus?: 'completed' | 'killed';
+        disposition?: 'terminal' | 'recovery-bounce';
+        origin?: 'operator' | 'autonomous';
+        knownDead?: boolean;
     }): Promise<{
         terminated: boolean;
         skipped?: string;
@@ -355,10 +428,17 @@ export declare class SessionManager extends EventEmitter {
         sessions: Session[];
     };
     /**
-     * Fast startup purge — immediately remove session records for dead tmux sessions.
-     * Called once at server boot BEFORE monitoring starts, to prevent the death spiral
-     * where stale sessions overwhelm startup and block health checks.
-     * Uses a short timeout (1s) per session to fail fast.
+     * Fast startup purge — remove session records for sessions that are *definitively*
+     * dead. Called once at server boot BEFORE monitoring starts, to prevent the death
+     * spiral where stale records overwhelm startup and block health checks.
+     *
+     * UNIFIED-SESSION-LIFECYCLE §P1 (the 2026-05-27 fix): liveness is resolved from a
+     * single `tmux list-sessions` via the tri-state oracle, NOT a per-session
+     * `has-session` with a 1s timeout. The old code treated a timeout (tmux busy at
+     * boot) identically to "session gone" and mass-purged live sessions — "9 of 9".
+     * Now ONLY a `dead` verdict (server reachable + exact id absent) purges; `alive`
+     * and `indeterminate` are kept. An indeterminate session lingers one extra tick
+     * (cheap, caught by monitoring) rather than being falsely reaped (expensive).
      */
     purgeDeadSessions(): Promise<number>;
     /**

package/dist/core/SessionManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SessionManager.d.ts","sourceRoot":"","sources":["../../src/core/SessionManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAS3C,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,oCAAoC;AACpC,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,CAAC;AAEtE,qEAAqE;AACrE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,iBAAiB,EAAE,CAAC;IACnC,cAAc,EAAE,cAAc,CAAC;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAGD,OAAO,EAAE,UAAU,EAAqB,MAAM,iBAAiB,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAGjE,OAAO,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAiB,SAAS,EAAE,MAAM,YAAY,CAAC;AAC1F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAQ9E,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAsEjD,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpC;;;;;OAKG;IACH,iBAAiB,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;CAC1C;AAED,qBAAa,cAAe,SAAQ,YAAY;IAC9C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,KAAK,CAAe;IAC5B,OAAO,CAAC,eAAe,CAA+C;IACtE,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,UAAU,CAA2B;IAC7C,OAAO,CAAC,YAAY,CAAuB;IAE3C,yFAAyF;IACzF,OAAO,CAAC,eAAe,CAA6B;IAEpD,wDAAwD;IACxD,OAAO,CAAC,aAAa,CAAK;IAE1B,iGAAiG;IACjG,OAAO,CAAC,eAAe,CAAC,CAAgC;IAExD,2GAA2G;IAC3G,OAAO,CAAC,qBAAqB,CAAC,CAAgC;IAE9D;;;+FAG2F;IAC3F,OAAO,CAAC,mBAAmB,CAAC,CAAkD;IAE9E,mFAAmF;IACnF,OAAO,CAAC,cAAc,CAAC,CAAgB;IAEvC,sGAAsG;IACtG,OAAO,CAAC,WAAW,CAA6B;IAEhD;;qEAEiE;IACjE,OAAO,CAAC,eAAe,CAAqB;IAE5C;gFAC4E;IAC5E,OAAO,CAAC,WAAW,CAAqB;IAExC;2FACuF;IACvF,OAAO,CAAC,iBAAiB,CAA4E;IAErG;;wFAEoF;IACpF,OAAO,CAAC,mBAAmB,CAAqB;IAEhD;mFAC+E;IAC/E,OAAO,CAAC,YAAY,CAAqB;IAEzC;;;;OAIG;IACH,OAAO,CAAC,sBAAsB,CAAqB;IAEnD;yEACqE;IACrE,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,sBAAsB,CAAiB;IAE/C,yFAAyF;IACzF,OAAO,CAAC,eAAe,CAA+D;IAEtF,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAuB;gBAE3B,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,YAAY;IAM7D,qFAAqF;IACrF,OAAO,KAAK,wBAAwB,GAEnC;IAED;;qEAEiE;IACjE,OAAO,KAAK,6BAA6B,GAExC;IAED,qFAAqF;IACrF,OAAO,KAAK,2BAA2B,GAEtC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAChB,EAAE,EAAE,OAAO,sBAAsB,EAAE,eAAe,EAClD,QAAQ,GAAE,MAAM,GAAG,IAAW,GAC7B,IAAI;IAKP;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IA4B1B,OAAO,CAAC,iBAAiB;IAczB;;;OAGG;IACH,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAK5D;;;;OAIG;IACH,kBAAkB,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,GAAG,IAAI;IAIhE;;;;;;;;;;;;OAYG;IACH,sBAAsB,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,IAAI;IAItF;;;;;OAKG;IACH,wBAAwB,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,GAAG,IAAI;IAItE;;;OAGG;IACH,iBAAiB,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAWhD;;;;OAIG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAI5D;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAIxC;;;;OAIG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAK9C;;mFAE+E;IAC/E,oBAAoB,IAAI,MAAM,EAAE;IAIhC;4EACwE;IACxE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAIpC,2DAA2D;IAC3D,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAIrC,oDAAoD;IACpD,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAIrC;;;;;;;;;;;;OAYG;IACG,gBAAgB,CACpB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAA;KAAE,GAC9C,OAAO,CAAC;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAmCrD;;;;OAIG;IACH,kBAAkB,CAAC,eAAe,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI;IAS1E;;OAEG;IACH,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS;IAI5D;;;OAGG;IACH,OAAO,CAAC,eAAe;IA2BvB;;;;;;OAMG;IACH,eAAe,CAAC,UAAU,GAAE,MAAa,GAAG,IAAI;YAYlC,WAAW;IA+PzB;;OAEG;IACH,cAAc,IAAI,IAAI;IAOtB;;;;;;;OAOG;IACG,YAAY,CAAC,OAAO,EAAE;QAC1B,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf;;;uCAG+B;QAC/B,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;QAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,OAAO,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;QAC9B,YAAY,CAAC,EAAE,KAAK,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,CAAC;QAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,yFAAyF;QACzF,SAAS,CAAC,EAAE,qBAAqB,CAAC;QAClC;;mEAE2D;QAC3D,kBAAkB,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;QAC3C;;;;4EAIoE;QACpE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB;;;;uCAI+B;QAC/B,kBAAkB,CAAC,EAAE,OAAO,CAAC;KAC9B,GAAG,OAAO,CAAC,OAAO,CAAC;IAoMpB;;;OAGG;IACH,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAmC5C;;;;;;;;OAQG;YACW,mBAAmB;IAuCjC;;OAEG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IA6CvC;;;;;;;;;OASG;IACH,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAiEhD;;OAEG;IACH,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,GAAE,MAAY,GAAG,MAAM,GAAG,IAAI;IAkBtE;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAmD;IACzF;;mDAE+C;IAC/C,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAGrD;;;sEAGkE;IAClE,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS;IAG3E,OAAO,CAAC,mBAAmB;IAwB3B;;OAEG;IACH,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAqBtD;;;;OAIG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO;IAclD;;;;;OAKG;IACH,mBAAmB,IAAI,OAAO,EAAE;IAShC;;;;OAIG;IACH,wBAAwB,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,EAAE,CAAA;KAAE;IAIlE;;;;;OAKG;IACG,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;IAyB1C;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB;IAiF3C;;OAEG;IACH,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAS9C;;OAEG;IACH,qBAAqB,IAAI,MAAM,EAAE;IA2BjC;;;;;OAKG;IACH,oBAAoB,IAAI,MAAM,EAAE;IAmDhC;;;;OAIG;IACG,uBAAuB,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,qBAAqB,CAAC;QAAC,kBAAkB,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IA8KvR;;;;;;;;;;;;;OAaG;YACW,oBAAoB;IAoGlC;;;;;;OAMG;IACG,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QAC9C,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,GAAG,OAAO,CAAC,MAAM,CAAC;IAqFnB;;;;;;;OAOG;IACH;;;;OAIG;IACH,uBAAuB,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAoB1E;;;;;;;;;;;OAWG;IACG,gCAAgC,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAyBnG,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO;IAwDpJ;;;OAGG;IACH,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAQ5C;;OAEG;IACH,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS;IAI3G;;;OAGG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;IAwBhG;;;;;OAKG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;IAoCnG;;;OAGG;IACH,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAenD;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IA2FzD;;;;;;;;;;;;;;;;OAgBG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,SAAsB,GAAG,OAAO;IAgB/F;;;OAGG;IACH,OAAO,CAAC,SAAS;IAgGjB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,eAAe;IAmDvB;;;;;;;OAOG;IACH,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAa5D;;;;;;OAMG;IACH,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAoBlE;;;OAGG;IACG,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,GAAE,MAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAqB1F;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAmD1B;;;;;;;;;OASG;YACW,2BAA2B;IA6BzC,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAcxC,OAAO,CAAC,UAAU;CAGnB"}
+{"version":3,"file":"SessionManager.d.ts","sourceRoot":"","sources":["../../src/core/SessionManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAM3C,OAAO,EAAE,qBAAqB,EAAoC,MAAM,4BAA4B,CAAC;AACrG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAIhD,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,oCAAoC;AACpC,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,CAAC;AAEtE,qEAAqE;AACrE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,iBAAiB,EAAE,CAAC;IACnC,cAAc,EAAE,cAAc,CAAC;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAGD,OAAO,EAAE,UAAU,EAAqB,MAAM,iBAAiB,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAGjE,OAAO,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAiB,SAAS,EAAE,MAAM,YAAY,CAAC;AAC1F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAQ9E,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAsEjD,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpC;;;;;OAKG;IACH,iBAAiB,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;CAC1C;AAED,qBAAa,cAAe,SAAQ,YAAY;IAC9C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,KAAK,CAAe;IAC5B,OAAO,CAAC,eAAe,CAA+C;IACtE,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,UAAU,CAA2B;IAC7C,OAAO,CAAC,YAAY,CAAuB;IAE3C,yFAAyF;IACzF,OAAO,CAAC,eAAe,CAA6B;IAEpD,wDAAwD;IACxD,OAAO,CAAC,aAAa,CAAK;IAE1B,iGAAiG;IACjG,OAAO,CAAC,eAAe,CAAC,CAAgC;IAExD,2GAA2G;IAC3G,OAAO,CAAC,qBAAqB,CAAC,CAAgC;IAC9D,uEAAuE;IACvE,OAAO,CAAC,SAAS,CAAC,CAAY;IAC9B;gFAC4E;IAC5E,OAAO,CAAC,yBAAyB,CAAqB;IACtD,oFAAoF;IACpF,OAAO,CAAC,cAAc,CAAC,CAAgB;IAEvC;;;+FAG2F;IAC3F,OAAO,CAAC,mBAAmB,CAAC,CAAkD;IAE9E,mFAAmF;IACnF,OAAO,CAAC,cAAc,CAAC,CAAgB;IAEvC,sGAAsG;IACtG,OAAO,CAAC,WAAW,CAA6B;IAEhD;;qEAEiE;IACjE,OAAO,CAAC,eAAe,CAAqB;IAE5C;gFAC4E;IAC5E,OAAO,CAAC,WAAW,CAAqB;IAExC;2FACuF;IACvF,OAAO,CAAC,iBAAiB,CAA4E;IAErG;;wFAEoF;IACpF,OAAO,CAAC,mBAAmB,CAAqB;IAEhD;mFAC+E;IAC/E,OAAO,CAAC,YAAY,CAAqB;IAEzC;;;;OAIG;IACH,OAAO,CAAC,sBAAsB,CAAqB;IAEnD;yEACqE;IACrE,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,sBAAsB,CAAiB;IAE/C,yFAAyF;IACzF,OAAO,CAAC,eAAe,CAA+D;IAEtF,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAuB;gBAE3B,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,YAAY;IAM7D;;oDAEgD;IAChD,OAAO,CAAC,eAAe,CAAsC;IAC7D,OAAO,KAAK,cAAc,GAQzB;IAED;;mEAE+D;IAC/D,iBAAiB,CAAC,MAAM,EAAE,qBAAqB,GAAG,IAAI;IAItD,qFAAqF;IACrF,OAAO,KAAK,wBAAwB,GAEnC;IAED;;qEAEiE;IACjE,OAAO,KAAK,6BAA6B,GAExC;IAED,qFAAqF;IACrF,OAAO,KAAK,2BAA2B,GAEtC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAChB,EAAE,EAAE,OAAO,sBAAsB,EAAE,eAAe,EAClD,QAAQ,GAAE,MAAM,GAAG,IAAW,GAC7B,IAAI;IAKP;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IA4B1B,OAAO,CAAC,iBAAiB;IAczB;;;OAGG;IACH,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAK5D;;;;OAIG;IACH,kBAAkB,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,GAAG,IAAI;IAIhE;;;;;;;;;;;;OAYG;IACH,sBAAsB,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,IAAI;IAItF;;;;;OAKG;IACH,wBAAwB,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,GAAG,IAAI;IAItE;;;;;;;OAOG;IACH,YAAY,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI;IAIpC;;;;;OAKG;IACH,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI;IAK/D;;;;;;OAMG;IACG,kBAAkB,CACtB,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,eAAe,CAAC,CAAA;KAAE,CAAC;IAW7F;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,EAAE,MAAM,OAAO,GAAG,IAAI;IAIxC;;;OAGG;IACH,iBAAiB,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAWhD;;;;OAIG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAI5D;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAIxC;;;;OAIG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAK9C;;mFAE+E;IAC/E,oBAAoB,IAAI,MAAM,EAAE;IAIhC;4EACwE;IACxE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAIpC,2DAA2D;IAC3D,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAIrC,oDAAoD;IACpD,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAIrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACG,gBAAgB,CACpB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;QACL,WAAW,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;QACrC,WAAW,CAAC,EAAE,UAAU,GAAG,iBAAiB,CAAC;QAC7C,MAAM,CAAC,EAAE,UAAU,GAAG,YAAY,CAAC;QACnC,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,GACA,OAAO,CAAC;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA2ErD;;;;OAIG;IACH,kBAAkB,CAAC,eAAe,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI;IAS1E;;OAEG;IACH,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS;IAI5D;;;OAGG;IACH,OAAO,CAAC,eAAe;IA2BvB;;;;;;OAMG;IACH,eAAe,CAAC,UAAU,GAAE,MAAa,GAAG,IAAI;YAYlC,WAAW;IAgQzB;;OAEG;IACH,cAAc,IAAI,IAAI;IAOtB;;;;;;;OAOG;IACG,YAAY,CAAC,OAAO,EAAE;QAC1B,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf;;;uCAG+B;QAC/B,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;QAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,OAAO,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;QAC9B,YAAY,CAAC,EAAE,KAAK,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,CAAC;QAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,yFAAyF;QACzF,SAAS,CAAC,EAAE,qBAAqB,CAAC;QAClC;;mEAE2D;QAC3D,kBAAkB,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;QAC3C;;;;4EAIoE;QACpE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB;;;;uCAI+B;QAC/B,kBAAkB,CAAC,EAAE,OAAO,CAAC;KAC9B,GAAG,OAAO,CAAC,OAAO,CAAC;IAoMpB;;;OAGG;IACH,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAmC5C;;;;;;;;OAQG;YACW,mBAAmB;IAuCjC;;OAEG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IA6CvC;;;;;;;;;OASG;IACH,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAiEhD;;OAEG;IACH,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,GAAE,MAAY,GAAG,MAAM,GAAG,IAAI;IAkBtE;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAmD;IACzF;;mDAE+C;IAC/C,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAGrD;;;sEAGkE;IAClE,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS;IAG3E,OAAO,CAAC,mBAAmB;IAwB3B;;OAEG;IACH,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAqBtD;;;;OAIG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO;IAclD;;;;;OAKG;IACH,mBAAmB,IAAI,OAAO,EAAE;IAShC;;;;OAIG;IACH,wBAAwB,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,EAAE,CAAA;KAAE;IAIlE;;;;;;;;;;;;OAYG;IACG,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;IA4C1C;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB;IAiF3C;;OAEG;IACH,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAS9C;;OAEG;IACH,qBAAqB,IAAI,MAAM,EAAE;IA2BjC;;;;;OAKG;IACH,oBAAoB,IAAI,MAAM,EAAE;IAmDhC;;;;OAIG;IACG,uBAAuB,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,qBAAqB,CAAC;QAAC,kBAAkB,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAmLvR;;;;;;;;;;;;;OAaG;YACW,oBAAoB;IAoGlC;;;;;;OAMG;IACG,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QAC9C,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,GAAG,OAAO,CAAC,MAAM,CAAC;IAqFnB;;;;;;;OAOG;IACH;;;;OAIG;IACH,uBAAuB,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAoB1E;;;;;;;;;;;OAWG;IACG,gCAAgC,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAyBnG,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO;IAwDpJ;;;OAGG;IACH,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAQ5C;;OAEG;IACH,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS;IAI3G;;;OAGG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;IAwBhG;;;;;OAKG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;IAoCnG;;;OAGG;IACH,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAenD;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IA2FzD;;;;;;;;;;;;;;;;OAgBG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,SAAsB,GAAG,OAAO;IAgB/F;;;OAGG;IACH,OAAO,CAAC,SAAS;IAgGjB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,eAAe;IAmDvB;;;;;;;OAOG;IACH,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAa5D;;;;;;OAMG;IACH,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAoBlE;;;OAGG;IACG,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,GAAE,MAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAqB1F;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAmD1B;;;;;;;;;OASG;YACW,2BAA2B;IA6BzC,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAcxC,OAAO,CAAC,UAAU;CAGnB"}

package/dist/core/SessionManager.js

@@ -13,6 +13,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { SessionLivenessOracle } from './SessionLivenessOracle.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 import { DegradationReporter } from '../monitoring/DegradationReporter.js';
 import { detectRateLimited } from '../monitoring/rateLimitDetection.js';
@@ -94,6 +95,13 @@ export class SessionManager extends EventEmitter {
     subagentChecker;
     /** Optional callback: is this session currently in active compaction recovery? If so, skip zombie kill. */
     activeRecoveryChecker;
+    /** Shared stateless KEEP-guard consulted by terminateSession (§P2). */
+    reapGuard;
+    /** Sessions the §P5 backstop has flagged long-`indeterminate` — excluded from
+     *  the ABSOLUTE spawn cap so unverifiable panes can't lock out spawning. */
+    longIndeterminateSessions = new Set();
+    /** Multi-machine lease/awake predicate gating autonomous reaps (§Multi-machine). */
+    isAwakeMachine;
     /** Optional callback: is this tmux session currently bound to a live messaging topic
      *  (Telegram/Slack/iMessage)? Returns a stable identifier (e.g. topic ID or channel ID)
      *  when bound, null otherwise. When bound, the zombie-kill threshold is extended via
@@ -139,6 +147,22 @@ export class SessionManager extends EventEmitter {
         this.config = config;
         this.state = state;
     }
+    /** Lazily-constructed tri-state liveness oracle (UNIFIED-SESSION-LIFECYCLE §P1).
+     *  Backs the boot purge and isSessionAliveAsync so a slow/unreachable tmux is
+     *  treated as `indeterminate`, never `dead`. */
+    _livenessOracle = null;
+    get livenessOracle() {
+        if (!this._livenessOracle) {
+            this._livenessOracle = new SessionLivenessOracle({ tmuxPath: this.config.tmuxPath, exec: execFileAsync }, this.config.liveness);
+        }
+        return this._livenessOracle;
+    }
+    /** Test/DI seam: inject a liveness oracle (e.g. one with a scripted exec).
+     *  Production builds the oracle lazily from config; this lets unit tests drive
+     *  the alive/dead/indeterminate verdicts deterministically. */
+    setLivenessOracle(oracle) {
+        this._livenessOracle = oracle;
+    }
     /** Effective idle-at-prompt kill threshold (config override or hardcoded default) */
     get effectiveIdleKillMinutes() {
         return this.config.idlePromptKillMinutes ?? FALLBACK_IDLE_PROMPT_KILL_MINUTES;
@@ -250,6 +274,57 @@ rm()  { "${shimRunner}" rm  "$@"; }
     setActiveRecoveryChecker(checker) {
         this.activeRecoveryChecker = checker;
     }
+    /**
+     * Register the shared ReapGuard (UNIFIED-SESSION-LIFECYCLE §P2). Once set,
+     * every AUTONOMOUS terminate consults it: a non-null KEEP reason makes the
+     * terminate a no-op `{ terminated:false, skipped:<reason> }`. Wired in server.ts
+     * with the same signal closures that back SessionReaper, so a killer can only
+     * *request* a kill — the authority refuses to end a guarded session. Operator
+     * kills bypass the guard. Unset (tests/standalone) → no guard consult.
+     */
+    setReapGuard(guard) {
+        this.reapGuard = guard;
+    }
+    /**
+     * Flag/unflag a session as long-`indeterminate` (UNIFIED-SESSION-LIFECYCLE §P5).
+     * Driven by the StaleSessionBackstop. A flagged session still counts toward the
+     * soft scheduler cap, but is excluded from the ABSOLUTE `maxSessions × 3` cap so
+     * a fleet of unverifiable panes can never lock a human out of spawning.
+     */
+    markLongIndeterminate(sessionId, isLong) {
+        if (isLong)
+            this.longIndeterminateSessions.add(sessionId);
+        else
+            this.longIndeterminateSessions.delete(sessionId);
+    }
+    /**
+     * Resolve tri-state liveness for many sessions from ONE tmux snapshot via the
+     * P1 oracle (UNIFIED-SESSION-LIFECYCLE §P5 backstop). `reachable` is false when
+     * the snapshot was non-authoritative (control plane unreachable) — in which
+     * case every session resolves `indeterminate`. Shares the oracle's short-TTL
+     * cache, so the backstop and boot-purge never double-probe within a tick.
+     */
+    async probeLivenessBatch(tmuxSessions) {
+        const results = await this.livenessOracle.probeAll(tmuxSessions);
+        const liveness = new Map();
+        for (const [name, r] of results)
+            liveness.set(name, r.liveness);
+        // With a single authoritative snapshot, a session is only `indeterminate`
+        // when the whole snapshot was non-authoritative — i.e. the server is
+        // unreachable. So "reachable" ⟺ at least one definitive (alive/dead) verdict.
+        const reachable = tmuxSessions.length === 0 || [...liveness.values()].some((l) => l !== 'indeterminate');
+        return { reachable, liveness };
+    }
+    /**
+     * Register the multi-machine lease/awake predicate. When set and it returns
+     * false, an AUTONOMOUS terminate is a no-op `skipped:'not-lease-holder'` — only
+     * the awake/lease-holding machine may autonomously reap; a standby may detect
+     * and signal but never kill another machine's sessions. Operator kills bypass.
+     * Unset → treated as awake (single-machine default).
+     */
+    setAwakeChecker(fn) {
+        this.isAwakeMachine = fn;
+    }
     /**
      * Set the Prompt Gate InputDetector for prompt monitoring.
      * When set, monitorTick() will capture output and feed it to the detector.
@@ -307,14 +382,31 @@ rm()  { "${shimRunner}" rm  "$@"; }
         return this.reapingSessions.has(sessionId);
     }
     /**
-     * Single-writer session termination (SESSION-REAPER-SPEC §3.6). Both the
-     * idle-kill path and the SessionReaper funnel through this so a session is
-     * killed at most once with exactly-once `beforeSessionKill`/`sessionComplete`
+     * Single-writer session termination — the sole ReapAuthority
+     * (UNIFIED-SESSION-LIFECYCLE §P0, building on SESSION-REAPER-SPEC §3.6). EVERY
+     * autonomous killer funnels through this so a session is killed at most once,
+     * with exactly-once `beforeSessionKill`/`sessionComplete`/`sessionReaped`
      * emission and a correct `endedReason`.
      *
-     * Compare-and-set semantics: a session that is not in a live state
-     * ('starting'/'running'), or whose termination is already in flight, is a
-     * no-op — this is what prevents the idle-kill ↔ reaper double-kill race.
+     * The authority holds the safety checks so a killer can only *request* a kill:
+     *  - CAS on live status + an in-flight guard (prevents the double-kill race).
+     *  - `protectedSessions` (never kill).
+     *  - Lease-holder gate: an AUTONOMOUS reap on a standby machine is a no-op
+     *    `skipped:'not-lease-holder'` — only the awake machine reaps.
+     *  - ReapGuard (§P2): an AUTONOMOUS reap of a session the guard says to KEEP is
+     *    a no-op `skipped:<keep-reason>` — even a buggy killer cannot end a guarded
+     *    session.
+     * `origin:'operator'` bypasses the lease-gate and the guard (an explicit human
+     * kill must always happen). Default `origin` is `'autonomous'` so an in-process
+     * caller can never accidentally mint operator privilege.
+     *
+     * Re-entrancy: the guard is consulted BEFORE this call acquires its own
+     * in-flight lock, so the authority's lock for the kill it is performing is
+     * never misread by the guard.
+     *
+     * `disposition:'recovery-bounce'` marks a kill-to-respawn (SessionRecovery,
+     * version-skew, context-exhaustion) so the §P3 notifier stays silent — that is
+     * a bounce, not a disappearance. Default `'terminal'`.
      *
      * @returns `{ terminated: true }` on a kill performed by THIS call, or
      *          `{ terminated: false, skipped }` describing why it was a no-op.
@@ -327,8 +419,42 @@ rm()  { "${shimRunner}" rm  "$@"; }
         if (session.status !== 'running' && session.status !== 'starting') {
             return { terminated: false, skipped: `already-${session.status}` };
         }
-        if (this.config.protectedSessions.includes(session.tmuxSession)) {
-            return { terminated: false, skipped: 'protected' };
+        const origin = opts?.origin ?? 'autonomous';
+        const disposition = opts?.disposition ?? 'terminal';
+        // ── Authority gates (autonomous only; operator bypasses) ──
+        // An `origin:'operator'` kill — stamped ONLY by the Bearer-authed HTTP route
+        // layer — must always happen: the user clicked "kill". It bypasses protected,
+        // the lease gate, and the KEEP-guard. Autonomous killers (the default) can
+        // only *request*; the authority holds the safety checks.
+        if (origin === 'autonomous') {
+            // Protected set — never autonomously reap a protected session.
+            if (this.config.protectedSessions.includes(session.tmuxSession)) {
+                this.emit('reapBlocked', { session, reason, skipped: 'protected', origin });
+                return { terminated: false, skipped: 'protected' };
+            }
+            // Lease-holder gate: a standby machine never reaps another machine's sessions.
+            if (this.isAwakeMachine && !this.isAwakeMachine()) {
+                this.emit('reapBlocked', { session, reason, skipped: 'not-lease-holder', origin });
+                return { terminated: false, skipped: 'not-lease-holder' };
+            }
+            // ReapGuard: refuse to end a session the guard says to KEEP. Consulted
+            // before the in-flight lock is acquired (re-entrancy ordering).
+            //
+            // `knownDead` bypass (boot-purge, #1): the caller has already proven the
+            // session is `dead` via the P1 oracle (tmux server reachable + exact id
+            // absent). The guard exists to protect a LIVE-but-busy session from being
+            // mistaken for dead — its topic-state KEEP reasons (recent-user-message,
+            // open-commitment) are liveness-blind, so consulting it on a proven-dead
+            // session would pin a tombstone in the running list and re-create the boot
+            // death-spiral the purge guards against. A proven-dead session has no
+            // liveness to protect, so skip the guard. Lease + protected + CAS still apply.
+            if (!opts?.knownDead) {
+                const blocked = this.reapGuard?.blockedReason(session);
+                if (blocked) {
+                    this.emit('reapBlocked', { session, reason, skipped: blocked.reason, origin });
+                    return { terminated: false, skipped: blocked.reason };
+                }
+            }
         }
         // In-flight guard: a concurrent terminate already owns this session.
         if (this.terminating.has(sessionId)) {
@@ -348,6 +474,9 @@ rm()  { "${shimRunner}" rm  "$@"; }
             session.endedReason = reason;
             this.state.saveSession(session);
             this.emit('sessionComplete', session);
+            // The single reap-notification signal (§P3): terminal reaps may reach the
+            // user; recovery-bounce reaps are silent. One emission, at the one chokepoint.
+            this.emit('sessionReaped', { session, reason, disposition, origin });
             this.idlePromptSince.delete(session.id);
             this.reapingSessions.delete(session.id);
             return { terminated: true };
@@ -527,20 +656,17 @@ rm()  { "${shimRunner}" rm  "$@"; }
                                     injectedAt: pendingInjection.injectedAt,
                                 });
                             }
-                            console.warn(`[SessionManager] Session "${session.name}" exceeded timeout (${Math.round(elapsed)}m > ${maxMinutes}m) and is idle. Killing.`);
-                            // Emit beforeSessionKill BEFORE destroying the tmux session so
-                            // listeners (e.g. TopicResumeMap) can discover the Claude UUID.
-                            this.emit('beforeSessionKill', session);
-                            try {
-                                await execFileAsync(this.config.tmuxPath, ['kill-session', '-t', `=${session.tmuxSession}`]);
-                            }
-                            catch {
-                                // @silent-fallback-ok — tmux kill, session may be dead
-                            }
-                            session.status = 'killed';
-                            session.endedAt = new Date().toISOString();
-                            this.state.saveSession(session);
-                            this.emit('sessionComplete', session);
+                            console.warn(`[SessionManager] Session "${session.name}" exceeded timeout (${Math.round(elapsed)}m > ${maxMinutes}m) and is idle. Requesting kill via ReapAuthority.`);
+                            // Route through the single ReapAuthority (§P0) instead of an inline
+                            // kill: this restores the beforeSessionKill/sessionComplete emission,
+                            // adds the sessionReaped signal + reap-log entry, applies the lease
+                            // gate, and — critically — gains the P2 KEEP-guard's topic-bound
+                            // grace, so a session that just received a user message is not
+                            // age-killed out from under the user.
+                            await this.terminateSession(session.id, 'age-limit', {
+                                finalStatus: 'killed',
+                                disposition: 'terminal',
+                            });
                             continue;
                         }
                     }
@@ -646,8 +772,11 @@ rm()  { "${shimRunner}" rm  "$@"; }
                                 const bindingNote = binding != null ? ` (topic-bound, threshold ${killThresholdMinutes}m)` : ` (threshold ${killThresholdMinutes}m)`;
                                 console.warn(`[SessionManager] Session "${session.name}" idle at prompt for ${Math.round(idleMs / 60_000)}m with no active processes${bindingNote}. Killing zombie.`);
                                 // Funnel through the single-writer path so the reaper and this
-                                // idle-kill can never double-kill or double-emit (§3.6).
-                                await this.terminateSession(session.id, 'idle-zombie');
+                                // idle-kill can never double-kill or double-emit (§3.6). Explicit
+                                // terminal disposition → the §P3 notifier surfaces it to the user.
+                                await this.terminateSession(session.id, 'idle-zombie', {
+                                    disposition: 'terminal',
+                                });
                                 continue;
                             }
                         }
@@ -1170,32 +1299,58 @@ rm()  { "${shimRunner}" rm  "$@"; }
         return { count: this._cachedRunningCount, sessions: this._cachedRunningSessions };
     }
     /**
-     * Fast startup purge — immediately remove session records for dead tmux sessions.
-     * Called once at server boot BEFORE monitoring starts, to prevent the death spiral
-     * where stale sessions overwhelm startup and block health checks.
-     * Uses a short timeout (1s) per session to fail fast.
+     * Fast startup purge — remove session records for sessions that are *definitively*
+     * dead. Called once at server boot BEFORE monitoring starts, to prevent the death
+     * spiral where stale records overwhelm startup and block health checks.
+     *
+     * UNIFIED-SESSION-LIFECYCLE §P1 (the 2026-05-27 fix): liveness is resolved from a
+     * single `tmux list-sessions` via the tri-state oracle, NOT a per-session
+     * `has-session` with a 1s timeout. The old code treated a timeout (tmux busy at
+     * boot) identically to "session gone" and mass-purged live sessions — "9 of 9".
+     * Now ONLY a `dead` verdict (server reachable + exact id absent) purges; `alive`
+     * and `indeterminate` are kept. An indeterminate session lingers one extra tick
+     * (cheap, caught by monitoring) rather than being falsely reaped (expensive).
      */
     async purgeDeadSessions() {
         const running = this.state.listSessions({ status: 'running' });
         if (running.length === 0)
             return 0;
+        const verdicts = await this.livenessOracle.probeAll(running.map((s) => s.tmuxSession));
         let purged = 0;
+        let kept = 0;
+        let indeterminate = 0;
+        let skipped = 0;
         for (const session of running) {
-            try {
-                execFileSync(this.config.tmuxPath, ['has-session', '-t', `=${session.tmuxSession}`], {
-                    stdio: 'ignore', timeout: 1000,
+            const v = verdicts.get(session.tmuxSession);
+            if (v?.liveness === 'dead') {
+                // Route through the single ReapAuthority (§P0) so the reap is lease-gated,
+                // recorded in the reap-log, and emits the standard lifecycle events. The
+                // KEEP-guard is bypassed via `knownDead` — the oracle has already proven
+                // this session dead, and the guard's liveness-blind topic-state KEEPs would
+                // otherwise pin a tombstone and re-create the death-spiral.
+                const r = await this.terminateSession(session.id, 'boot-purge-dead', {
+                    knownDead: true,
+                    finalStatus: 'completed',
                 });
+                if (r.terminated)
+                    purged++;
+                else
+                    skipped++; // not-lease-holder / protected — recorded, kept for next awake tick
             }
-            catch {
-                // tmux session doesn't exist — purge the record
-                session.status = 'completed';
-                session.endedAt = new Date().toISOString();
-                this.state.saveSession(session);
-                purged++;
+            else {
+                kept++;
+                if (v?.liveness === 'indeterminate')
+                    indeterminate++;
             }
         }
-        if (purged > 0) {
-            console.log(`[SessionManager] Startup purge: removed ${purged} dead session(s) of ${running.length} tracked`);
+        if (purged > 0 || indeterminate > 0 || skipped > 0) {
+            console.log(`[SessionManager] Startup purge: removed ${purged} dead session(s) of ${running.length} tracked` +
+                (indeterminate > 0
+                    ? ` (${indeterminate} indeterminate — KEPT, will re-verify on the next tick rather than risk a false purge)`
+                    : '') +
+                (skipped > 0
+                    ? ` (${skipped} dead but not reaped here — standby/protected, deferred to the awake machine)`
+                    : ''));
         }
         return purged;
     }
@@ -1401,7 +1556,12 @@ rm()  { "${shimRunner}" rm  "$@"; }
         // Safety valve: still cap at maxSessions * 3 to prevent runaway sessions.
         const runningSessions = this.listRunningSessions();
         const absoluteLimit = this.config.maxSessions * 3;
-        if (runningSessions.length >= absoluteLimit) {
+        // §P5: exclude long-`indeterminate` sessions (unverifiable panes flagged by the
+        // StaleSessionBackstop) from the ABSOLUTE cap, so a fleet of them can never lock
+        // a human out of spawning — the death-spiral the boot purge guarded against
+        // cannot relocate here.
+        const countable = runningSessions.filter(s => !this.longIndeterminateSessions.has(s.id));
+        if (countable.length >= absoluteLimit) {
             throw new Error(`Absolute session limit (${absoluteLimit}) reached. ` +
                 `Running: ${runningSessions.map(s => s.name).join(', ')}`);
         }