instar 1.3.651 → 1.3.652

package/dist/monitoring/SessionReaper.d.ts

@@ -103,6 +103,20 @@ export interface SessionReaperConfig {
      *  breaker resets when the topic returns home / a pin-conflict hold engages /
      *  the session ends. Default 5 (~10 min of vetoes at the default 120s tick). */
     topicMovedVetoBreakerAttempts: number;
+    /** Post-transfer closeout CORRECTNESS gate (F1,
+     *  docs/specs/post-transfer-closeout-correctness.md). When true, the closeout
+     *  no longer terminates the live local session on a stale/unverified ownership
+     *  record: it consults `remoteOwnerHasLiveSession` and proceeds ONLY when the
+     *  owning machine genuinely HAS a live session for the topic (a real
+     *  duplicate). `false` (owner has no live session) / `'unknown'` / dep-absent →
+     *  WITHHOLD (fail-closed — never kill the sole live worker). It also re-keys the
+     *  closeout breaker counters on the stable TOPIC id (so a session-id churn
+     *  across respawn no longer resets the veto count) and passes the narrow
+     *  `bypassRecentUserMessageForConfirmedMove` on a liveness-CONFIRMED move so a
+     *  genuine leftover with a pre-move "recent" message can actually shed.
+     *  Ships DARK fleet-wide, LIVE on a dev agent via `resolveDevAgentGate`. When
+     *  OFF the closeout's observable behavior is byte-identical to today. */
+    closeoutLivenessGate: boolean;
 }
 export declare const DEFAULT_SESSION_REAPER_CONFIG: SessionReaperConfig;
 /**
@@ -183,6 +197,43 @@ export interface SessionReaperDeps {
      *  is unowned / owned by this machine / the pool is dark. Absent ⇒ the
      *  topic-moved closeout rule is inert. */
     topicOwnerElsewhere?: (topicId: number) => string | null;
+    /** Post-transfer closeout correctness (F1): the combined, ATOMIC owner read
+     *  the liveness-gated closeout uses — ONE registry read returning BOTH the
+     *  STABLE `machineId` (the un-nicknamed `reg.ownerOf(...)` value — the
+     *  liveness/snapshot key, immune to nickname rename/duplication) and the
+     *  `displayName` (= nickname ?? machineId — audit/operator text). Returning
+     *  both from one read guarantees the liveness key and the display text describe
+     *  the SAME owner from the SAME instant (no straddle across an ownership change).
+     *  null ⇒ the topic is not owned elsewhere. Consulted ONLY when
+     *  `closeoutLivenessGate` is on; absent-under-gate ⇒ the closeout fail-closes to
+     *  WITHHOLD (it never silently falls back to the display-only dep). */
+    topicOwnerElsewhereInfo?: (topicId: number) => {
+        machineId: string;
+        displayName: string;
+    } | null;
+    /** Post-transfer closeout correctness (F1): does the machine that OWNS this
+     *  topic (per the ownership registry) actually have a LIVE session for it right
+     *  now? Reads the machine-local liveness snapshot (NOT a live per-tick fetch).
+     *    state:true     → owner genuinely serving → local is a duplicate → may shed.
+     *    state:false    → owner has NO live session → local is the sole worker →
+     *                     WITHHOLD (never terminate it).
+     *    state:'unknown'→ liveness undeterminable (snapshot missing/stale, peer
+     *                     unreachable) → WITHHOLD (fail-closed; UNKNOWN must NEVER act).
+     *  `reachableAt` (ms) = the snapshot pass that produced the answer; backs the
+     *  true-side dwell-advancement (a confirm tick only counts when `reachableAt`
+     *  ADVANCED). Present on true/false, absent on 'unknown'. Absent dep ⇒ the
+     *  liveness gate is inert. */
+    remoteOwnerHasLiveSession?: (topicId: number, ownerMachineId: string) => {
+        state: boolean | 'unknown';
+        reachableAt?: number;
+    };
+    /** Post-transfer closeout correctness (F1, Part E freshest-interaction veto):
+     *  the LOCAL-RECEIPT timestamp (ms) of the bound topic's most-recent user
+     *  message, or null. SAME source the existing `recent-user-message` KEEP-guard
+     *  reads, so the basis is local wall-clock at message receipt. Used to withhold
+     *  the recent-message bypass when a user message arrived AFTER the liveness
+     *  snapshot (the local session the user is actively talking to is kept). */
+    recentUserMessageAt?: (topicId: number) => number | null;
     /** WS1.3: does the topic's placement PIN name THIS machine? A pin-conflict
      *  (pin=here, owner=elsewhere) means the divergence is reconciling TOWARD us —
      *  the closeout holds (do-not-act) instead of attacking the session the pin
@@ -210,6 +261,11 @@ export interface SessionReaperDeps {
      *  KEEP-guard is re-checked by the authority and still vetoes. */
     terminate: (sessionId: string, reason: string, opts?: {
         bypassActiveProcessKeep?: boolean;
+        /** Post-transfer closeout correctness (F1, Part E): lifts ONLY the
+         *  `recent-user-message` keep-reason (every other guard re-checked), passed
+         *  ONLY on a liveness-CONFIRMED genuine move so a duplicate leftover with a
+         *  pre-move "recent" message can shed. */
+        bypassRecentUserMessageForConfirmedMove?: boolean;
         workEvidence?: string[];
     }) => Promise<{
         terminated: boolean;
@@ -255,6 +311,27 @@ export interface Obs {
     /** When this session entered reap-pending (two-phase), if it has. */
     reapPendingSince?: number;
 }
+/**
+ * The closeout dwell-streak value. OFF mode uses the legacy `number | -1` (-1 =
+ * held sentinel). ON (gated) mode uses the richer struct so the dwell advances
+ * only across DISTINCT snapshot generations and the GC grace window applies to
+ * held + counting episodes uniformly:
+ *   - `{ kind: 'counting'; count; lastTrueReachableAt; lastSeenAt }` — `count` is
+ *     the consecutive-distinct-generation dwell; a `true` tick advances it only
+ *     when `reachableAt > lastTrueReachableAt`.
+ *   - `{ kind: 'held'; lastSeenAt }` — REPLACES the legacy `-1` sentinel for the
+ *     WITHHOLD / pin-conflict episodes (audited once; never confirms terminate);
+ *     `lastSeenAt` lets the GC grace window evict a held topic uniformly.
+ */
+export type TopicMovedStreakValue = number | {
+    kind: 'counting';
+    count: number;
+    lastTrueReachableAt: number;
+    lastSeenAt: number;
+} | {
+    kind: 'held';
+    lastSeenAt: number;
+};
 export declare class SessionReaper extends EventEmitter {
     private readonly cfg;
     private readonly deps;
@@ -268,14 +345,22 @@ export declare class SessionReaper extends EventEmitter {
     /** Consecutive busy-orphan-suspect ticks per session (observe-only dwell for
      *  `busyOrphanDetection`). Resets to 0 on any non-suspect tick. GC'd with obs. */
     private busyOrphanStreak;
-    /** Consecutive VETOED closeout terminate attempts per session (the WS1.2
-     *  P19 breaker counter). Distinct from the dwell streak: this counts only
-     *  real terminate() calls that came back vetoed. At
-     *  `topicMovedVetoBreakerAttempts` the closeout stops retrying for the
-     *  episode. Reset on success / topic-home / pin-conflict hold. GC'd with obs. */
+    /** Consecutive VETOED closeout terminate attempts (the WS1.2 P19 breaker
+     *  counter). Distinct from the dwell streak: this counts only real terminate()
+     *  calls that came back vetoed. At `topicMovedVetoBreakerAttempts` the closeout
+     *  stops retrying for the episode. Reset on success / topic-home / pin-conflict
+     *  hold. GC'd with obs.
+     *  Keyed on session.id when `closeoutLivenessGate` is OFF (legacy); on the
+     *  STABLE topic id when ON (so a session-id churn across respawn no longer
+     *  resets the count — the Secondary fix). Value is always a plain number. */
     private topicMovedVetoes;
-    /** Consecutive owned-elsewhere ticks per session (the topicMovedCloseout
-     *  dwell). Resets when the topic returns to this machine / unowned. GC'd with obs. */
+    /** Consecutive owned-elsewhere ticks (the topicMovedCloseout dwell). Resets
+     *  when the topic returns home / unowned. GC'd with obs.
+     *  OFF (legacy): keyed on session.id, value `number | -1` (-1 = held sentinel).
+     *  ON (gated): keyed on the stable topic id, value the richer struct below —
+     *  `lastTrueReachableAt` enforces dwell advancement (a confirm tick counts only
+     *  when the snapshot `reachableAt` advanced), `lastSeenAt` backs the GC grace
+     *  window so a held topic participates in eviction uniformly. */
     private topicMovedStreak;
     /** Last audited `verdict:keptBy` per session — so the decision audit logs only
      *  on a CHANGE, not every tick (auditability without per-tick log spam). */
@@ -334,6 +419,32 @@ export declare class SessionReaper extends EventEmitter {
     /** Active idle threshold (ms) for the current pressure tier. */
     private thresholdMs;
     private hourlyBudgetRemaining;
+    /**
+     * Post-transfer closeout — LEGACY path (closeoutLivenessGate OFF). Byte-identical
+     * observable behavior to the pre-correctness-fix code: session-id-keyed maps, no
+     * liveness check, no Part E bypass. Returns whether the session was terminated +
+     * the running reap count.
+     */
+    private runCloseoutLegacy;
+    /**
+     * Post-transfer closeout — GATED path (closeoutLivenessGate ON). The
+     * correctness fix: NEVER terminate the live local session on a stale/unverified
+     * ownership record. Resolves the owner ATOMICALLY (machineId + display), then
+     * consults `remoteOwnerHasLiveSession`:
+     *   true     → genuine move (real duplicate) → dwell→terminate (with Part E bypass).
+     *   false    → owner has no live session → WITHHOLD (neutral once-per-episode audit).
+     *   'unknown'/throw/dep-absent → WITHHOLD (fail-closed; UNKNOWN must NEVER act).
+     * Maps are keyed on the stable TOPIC id (Secondary fix) with the richer streak
+     * struct so the dwell advances only across DISTINCT snapshot generations.
+     */
+    private runCloseoutGated;
+    /**
+     * Shared closeout terminate machinery — the dwell has been met. Handles the P19
+     * breaker, dry-run, budget caps, the guarded terminate, and the veto/breaker
+     * audit. `key` is session.id (legacy) or the topic id (gated); `bypassRecentForMove`
+     * is passed through to terminate ONLY on a liveness-confirmed genuine move.
+     */
+    private attemptCloseoutTerminate;
     tick(): Promise<void>;
     private performReap;
     /** Emit a `decision` audit row only when a session's (verdict, keptBy) differs

package/dist/monitoring/SessionReaper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SessionReaper.d.ts","sourceRoot":"","sources":["../../src/monitoring/SessionReaper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,EAAoC,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE/F,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,CAAC;AAC9D,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,eAAe,CAAC;AAC/C,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,KAAK,CAAC;AAExC,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,uBAAuB,EAAE,MAAM,CAAC;IAChC,4BAA4B,EAAE,MAAM,CAAC;IACrC,4BAA4B,EAAE,MAAM,CAAC;IACrC,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,sBAAsB,EAAE,OAAO,CAAC;IAChC;gEAC4D;IAC5D,4BAA4B,EAAE,MAAM,CAAC;IACrC;;;;;4FAKwF;IACxF,+BAA+B,EAAE,OAAO,CAAC;IACzC;;uEAEmE;IACnE,sBAAsB,EAAE,MAAM,CAAC;IAC/B,yEAAyE;IACzE,sBAAsB,EAAE,MAAM,CAAC;IAC/B;;;;;;;;+EAQ2E;IAC3E,yBAAyB,EAAE,OAAO,CAAC;IACnC;;;;+EAI2E;IAC3E,sBAAsB,EAAE,MAAM,CAAC;IAC/B;;;;;;;;sFAQkF;IAClF,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;8CAE0C;IAC1C,sBAAsB,EAAE,MAAM,CAAC;IAC/B;;;;;oFAKgF;IAChF,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;uDAEmD;IACnD,sBAAsB,EAAE,MAAM,CAAC;IAC/B;;;;;;;oFAOgF;IAChF,6BAA6B,EAAE,MAAM,CAAC;CACvC;AAED,eAAO,MAAM,6BAA6B,EAAE,mBA2B3C,CAAC;AASF;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACvD,UAAU,EAAE;IAAE,sBAAsB,EAAE,MAAM,CAAC;IAAC,sBAAsB,EAAE,MAAM,CAAA;CAAE,GAC7E,eAAe,CAuBjB;AAUD,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,UAAU,CAAC;IACvB,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,UAAU,EAAE,eAAe,CAAC;IAC5B;;8EAE0E;IAC1E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;qFAGiF;IACjF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;4FAIwF;IACxF,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,YAAY,CAAC;IACnB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,mBAAmB,EAAE,MAAM,OAAO,EAAE,CAAC;IACrC,aAAa,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9D,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD;oFACgF;IAChF,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,GAAG,SAAS,CAAC;IACjE;;;4EAGwE;IACxE,oBAAoB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC;IACvD,mBAAmB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,aAAa,GAAG,WAAW,GAAG,SAAS,CAAC;IACtF,kFAAkF;IAClF,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,eAAe,CAAC;IACxD;;+DAE2D;IAC3D,oBAAoB,CAAC,EAAE,MAAM,MAAM,CAAC;IACpC,gBAAgB,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;IAChD,kBAAkB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IACnD,mBAAmB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;IACtD,6CAA6C;IAC7C,YAAY,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACrD;;;8CAG0C;IAC1C,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACzD;;;mDAG+C;IAC/C,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/C,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAClE,wBAAwB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACvD,iFAAiF;IACjF,mBAAmB,EAAE,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,CAAC;IACrE,uBAAuB,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC;IAC7D;;;;;;wEAMoE;IACpE,UAAU,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/C,iBAAiB,EAAE,MAAM,MAAM,EAAE,CAAC;IAClC,QAAQ,EAAE,MAAM,eAAe,CAAC;IAChC;;;;sEAIkE;IAClE,SAAS,EAAE,CACT,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;QAAE,uBAAuB,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,KAClE,OAAO,CAAC;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxD,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,YAAY,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,qDAAqD;IACrD,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACjD;;;;;qCAKiC;IACjC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACtG;;;;;uEAKmE;IACnE,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1C;2FACuF;IACvF,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,GAAG;IAClB,iDAAiD;IACjD,cAAc,EAAE,MAAM,CAAC;IACvB,0CAA0C;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,cAAc,EAAE,eAAe,CAAC;IAChC,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,aAAc,SAAQ,YAAY;IAC7C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAsB;IAC1C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,KAAK,CAAC,CAAiB;IAC/B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,GAAG,CAA0B;IACrC;8EAC0E;IAC1E,OAAO,CAAC,UAAU,CAAkD;IACpE;sFACkF;IAClF,OAAO,CAAC,gBAAgB,CAA6B;IACrD;;;;qFAIiF;IACjF,OAAO,CAAC,gBAAgB,CAA6B;IACrD;0FACsF;IACtF,OAAO,CAAC,gBAAgB,CAA6B;IACrD;gFAC4E;IAC5E,OAAO,CAAC,mBAAmB,CAA6B;IACxD,OAAO,CAAC,cAAc,CAAgB;IACtC,uEAAuE;IACvE,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,UAAU,CAAK;IAEvB;;mFAE+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;gBAEtB,IAAI,EAAE,iBAAiB,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC;IA2BvE,yEAAyE;IACzE,OAAO,CAAC,gBAAgB;IASxB,KAAK,IAAI,IAAI;IAMb,IAAI,IAAI,IAAI;IAIZ,gEAAgE;IAChE,OAAO,KAAK,YAAY,GAEvB;IAED,OAAO,CAAC,KAAK;IAgBb;;;;OAIG;IACH,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,aAAa,GAAG,WAAW,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IA+B7H;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,iBAAiB;IAmF3E;;;;;;;;;;OAUG;IACH,OAAO,CAAC,eAAe;IAyBvB;;;;;;;OAOG;IACH,OAAO,CAAC,2BAA2B;IAYnC,gEAAgE;IAChE,OAAO,CAAC,WAAW;IAMnB,OAAO,CAAC,qBAAqB;IAMvB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAgPb,WAAW;IA+DzB;;iFAE6E;IAC7E,OAAO,CAAC,sBAAsB;IAa9B,OAAO,CAAC,KAAK;IAKb,uDAAuD;IACvD,QAAQ,IAAI;QACV,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAC7E,QAAQ,EAAE,eAAe,CAAC;QAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjE,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,OAAO,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,UAAU,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;KAC3K;IA4BD;sEACkE;IAClE,WAAW,IAAI;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE;CAOzE;AAMD,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAQxF;AAED,qEAAqE;AACrE,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAQ1F;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAe/F"}
+{"version":3,"file":"SessionReaper.d.ts","sourceRoot":"","sources":["../../src/monitoring/SessionReaper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,EAAoC,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE/F,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,CAAC;AAC9D,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,eAAe,CAAC;AAC/C,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,KAAK,CAAC;AAExC,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,uBAAuB,EAAE,MAAM,CAAC;IAChC,4BAA4B,EAAE,MAAM,CAAC;IACrC,4BAA4B,EAAE,MAAM,CAAC;IACrC,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,sBAAsB,EAAE,OAAO,CAAC;IAChC;gEAC4D;IAC5D,4BAA4B,EAAE,MAAM,CAAC;IACrC;;;;;4FAKwF;IACxF,+BAA+B,EAAE,OAAO,CAAC;IACzC;;uEAEmE;IACnE,sBAAsB,EAAE,MAAM,CAAC;IAC/B,yEAAyE;IACzE,sBAAsB,EAAE,MAAM,CAAC;IAC/B;;;;;;;;+EAQ2E;IAC3E,yBAAyB,EAAE,OAAO,CAAC;IACnC;;;;+EAI2E;IAC3E,sBAAsB,EAAE,MAAM,CAAC;IAC/B;;;;;;;;sFAQkF;IAClF,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;8CAE0C;IAC1C,sBAAsB,EAAE,MAAM,CAAC;IAC/B;;;;;oFAKgF;IAChF,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;uDAEmD;IACnD,sBAAsB,EAAE,MAAM,CAAC;IAC/B;;;;;;;oFAOgF;IAChF,6BAA6B,EAAE,MAAM,CAAC;IACtC;;;;;;;;;;;;6EAYyE;IACzE,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED,eAAO,MAAM,6BAA6B,EAAE,mBA4B3C,CAAC;AASF;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACvD,UAAU,EAAE;IAAE,sBAAsB,EAAE,MAAM,CAAC;IAAC,sBAAsB,EAAE,MAAM,CAAA;CAAE,GAC7E,eAAe,CAuBjB;AAUD,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,UAAU,CAAC;IACvB,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,UAAU,EAAE,eAAe,CAAC;IAC5B;;8EAE0E;IAC1E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;qFAGiF;IACjF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;4FAIwF;IACxF,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,YAAY,CAAC;IACnB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,mBAAmB,EAAE,MAAM,OAAO,EAAE,CAAC;IACrC,aAAa,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9D,kBAAkB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD;oFACgF;IAChF,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,GAAG,SAAS,CAAC;IACjE;;;4EAGwE;IACxE,oBAAoB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC;IACvD,mBAAmB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,aAAa,GAAG,WAAW,GAAG,SAAS,CAAC;IACtF,kFAAkF;IAClF,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,eAAe,CAAC;IACxD;;+DAE2D;IAC3D,oBAAoB,CAAC,EAAE,MAAM,MAAM,CAAC;IACpC,gBAAgB,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;IAChD,kBAAkB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IACnD,mBAAmB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;IACtD,6CAA6C;IAC7C,YAAY,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACrD;;;8CAG0C;IAC1C,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACzD;;;;;;;;;2EASuE;IACvE,uBAAuB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjG;;;;;;;;;;;kCAW8B;IAC9B,yBAAyB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,KAC/D;QAAE,KAAK,EAAE,OAAO,GAAG,SAAS,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D;;;;;gFAK4E;IAC5E,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACzD;;;mDAG+C;IAC/C,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/C,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAClE,wBAAwB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACvD,iFAAiF;IACjF,mBAAmB,EAAE,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,CAAC;IACrE,uBAAuB,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC;IAC7D;;;;;;wEAMoE;IACpE,UAAU,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/C,iBAAiB,EAAE,MAAM,MAAM,EAAE,CAAC;IAClC,QAAQ,EAAE,MAAM,eAAe,CAAC;IAChC;;;;sEAIkE;IAClE,SAAS,EAAE,CACT,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;QACL,uBAAuB,CAAC,EAAE,OAAO,CAAC;QAClC;;;kDAG0C;QAC1C,uCAAuC,CAAC,EAAE,OAAO,CAAC;QAClD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB,KACE,OAAO,CAAC;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxD,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,YAAY,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,qDAAqD;IACrD,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACjD;;;;;qCAKiC;IACjC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACtG;;;;;uEAKmE;IACnE,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1C;2FACuF;IACvF,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,GAAG;IAClB,iDAAiD;IACjD,cAAc,EAAE,MAAM,CAAC;IACvB,0CAA0C;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,cAAc,EAAE,eAAe,CAAC;IAChC,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAC7B,MAAM,GACN;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACpF;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC,qBAAa,aAAc,SAAQ,YAAY;IAC7C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAsB;IAC1C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,KAAK,CAAC,CAAiB;IAC/B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,GAAG,CAA0B;IACrC;8EAC0E;IAC1E,OAAO,CAAC,UAAU,CAAkD;IACpE;sFACkF;IAClF,OAAO,CAAC,gBAAgB,CAA6B;IACrD;;;;;;;iFAO6E;IAC7E,OAAO,CAAC,gBAAgB,CAAsC;IAC9D;;;;;;qEAMiE;IACjE,OAAO,CAAC,gBAAgB,CAAqD;IAC7E;gFAC4E;IAC5E,OAAO,CAAC,mBAAmB,CAA6B;IACxD,OAAO,CAAC,cAAc,CAAgB;IACtC,uEAAuE;IACvE,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,UAAU,CAAK;IAEvB;;mFAE+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;gBAEtB,IAAI,EAAE,iBAAiB,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC;IA2BvE,yEAAyE;IACzE,OAAO,CAAC,gBAAgB;IASxB,KAAK,IAAI,IAAI;IAMb,IAAI,IAAI,IAAI;IAIZ,gEAAgE;IAChE,OAAO,KAAK,YAAY,GAEvB;IAED,OAAO,CAAC,KAAK;IAgBb;;;;OAIG;IACH,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,aAAa,GAAG,WAAW,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IA+B7H;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,iBAAiB;IAmF3E;;;;;;;;;;OAUG;IACH,OAAO,CAAC,eAAe;IAyBvB;;;;;;;OAOG;IACH,OAAO,CAAC,2BAA2B;IAYnC,gEAAgE;IAChE,OAAO,CAAC,WAAW;IAMnB,OAAO,CAAC,qBAAqB;IAM7B;;;;;OAKG;YACW,iBAAiB;IA0C/B;;;;;;;;;;OAUG;YACW,gBAAgB;IAoH9B;;;;;OAKG;YACW,wBAAwB;IA+DhC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YA+Lb,WAAW;IA+DzB;;iFAE6E;IAC7E,OAAO,CAAC,sBAAsB;IAa9B,OAAO,CAAC,KAAK;IAKb,uDAAuD;IACvD,QAAQ,IAAI;QACV,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAC7E,QAAQ,EAAE,eAAe,CAAC;QAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjE,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,OAAO,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,UAAU,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;KAC3K;IA4BD;sEACkE;IAClE,WAAW,IAAI;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE;CAOzE;AAMD,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAQxF;AAED,qEAAqE;AACrE,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAQ1F;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAe/F"}

package/dist/monitoring/SessionReaper.js

@@ -48,6 +48,7 @@ export const DEFAULT_SESSION_REAPER_CONFIG = {
     topicMovedCloseout: true,
     topicMovedConfirmTicks: 2,
     topicMovedVetoBreakerAttempts: 5,
+    closeoutLivenessGate: false,
 };
 /** Memory-pressure thresholds (freePct). Kept as constants — the existing
  *  behavior surface; CPU thresholds are the configurable addition. */
@@ -96,14 +97,22 @@ export class SessionReaper extends EventEmitter {
     /** Consecutive busy-orphan-suspect ticks per session (observe-only dwell for
      *  `busyOrphanDetection`). Resets to 0 on any non-suspect tick. GC'd with obs. */
     busyOrphanStreak = new Map();
-    /** Consecutive VETOED closeout terminate attempts per session (the WS1.2
-     *  P19 breaker counter). Distinct from the dwell streak: this counts only
-     *  real terminate() calls that came back vetoed. At
-     *  `topicMovedVetoBreakerAttempts` the closeout stops retrying for the
-     *  episode. Reset on success / topic-home / pin-conflict hold. GC'd with obs. */
+    /** Consecutive VETOED closeout terminate attempts (the WS1.2 P19 breaker
+     *  counter). Distinct from the dwell streak: this counts only real terminate()
+     *  calls that came back vetoed. At `topicMovedVetoBreakerAttempts` the closeout
+     *  stops retrying for the episode. Reset on success / topic-home / pin-conflict
+     *  hold. GC'd with obs.
+     *  Keyed on session.id when `closeoutLivenessGate` is OFF (legacy); on the
+     *  STABLE topic id when ON (so a session-id churn across respawn no longer
+     *  resets the count — the Secondary fix). Value is always a plain number. */
     topicMovedVetoes = new Map();
-    /** Consecutive owned-elsewhere ticks per session (the topicMovedCloseout
-     *  dwell). Resets when the topic returns to this machine / unowned. GC'd with obs. */
+    /** Consecutive owned-elsewhere ticks (the topicMovedCloseout dwell). Resets
+     *  when the topic returns home / unowned. GC'd with obs.
+     *  OFF (legacy): keyed on session.id, value `number | -1` (-1 = held sentinel).
+     *  ON (gated): keyed on the stable topic id, value the richer struct below —
+     *  `lastTrueReachableAt` enforces dwell advancement (a confirm tick counts only
+     *  when the snapshot `reachableAt` advanced), `lastSeenAt` backs the GC grace
+     *  window so a held topic participates in eviction uniformly. */
     topicMovedStreak = new Map();
     /** Last audited `verdict:keptBy` per session — so the decision audit logs only
      *  on a CHANGE, not every tick (auditability without per-tick log spam). */
@@ -383,6 +392,237 @@ export class SessionReaper extends EventEmitter {
         this.reapTimestamps = this.reapTimestamps.filter(t => t >= cutoff);
         return this.cfg.maxReapsPerHour - this.reapTimestamps.length;
     }
+    /**
+     * Post-transfer closeout — LEGACY path (closeoutLivenessGate OFF). Byte-identical
+     * observable behavior to the pre-correctness-fix code: session-id-keyed maps, no
+     * liveness check, no Part E bypass. Returns whether the session was terminated +
+     * the running reap count.
+     */
+    async runCloseoutLegacy(session, reapedThisTick) {
+        let otherOwner = null;
+        let pinnedHere = false;
+        try {
+            const topicId = this.deps.topicBinding(session.tmuxSession);
+            otherOwner = topicId != null ? (this.deps.topicOwnerElsewhere?.(topicId) ?? null) : null;
+            // WS1.3: pin-conflict = do-not-act (reconcile mid-flight TOWARD us).
+            pinnedHere = topicId != null && (this.deps.topicPinnedHere?.(topicId) ?? false);
+        }
+        catch {
+            otherOwner = null; /* @silent-fallback-ok — ownership signal failed → cannot reason → skip rule (safe withhold direction) */
+        }
+        if (otherOwner && pinnedHere) {
+            const prior = this.topicMovedStreak.get(session.id) ?? 0;
+            if (prior !== -1) {
+                this.audit('reap-skipped-topic-moved', session, { rule: 'topic-moved-away', otherOwner, skipped: 'pin-conflict-pending-reconcile' });
+                this.topicMovedStreak.set(session.id, -1);
+            }
+            this.topicMovedVetoes.delete(session.id);
+            return { terminated: false, reapedThisTick };
+        }
+        if (otherOwner) {
+            const streak = (this.topicMovedStreak.get(session.id) ?? 0) + 1;
+            this.topicMovedStreak.set(session.id, streak);
+            if (streak >= this.cfg.topicMovedConfirmTicks) {
+                const reason = `topic moved to ${otherOwner} — closing the leftover session on this machine (post-transfer closeout)`;
+                return this.attemptCloseoutTerminate({
+                    session, otherOwner, reason, streak,
+                    key: session.id, reapedThisTick, bypassRecentForMove: false,
+                });
+            }
+            return { terminated: false, reapedThisTick };
+        }
+        // owned-by-self / unowned — clear the episode (counting streak AND -1 sentinel).
+        if ((this.topicMovedStreak.get(session.id) ?? 0) !== 0) {
+            this.topicMovedStreak.set(session.id, 0);
+            this.topicMovedVetoes.delete(session.id);
+        }
+        return { terminated: false, reapedThisTick };
+    }
+    /**
+     * Post-transfer closeout — GATED path (closeoutLivenessGate ON). The
+     * correctness fix: NEVER terminate the live local session on a stale/unverified
+     * ownership record. Resolves the owner ATOMICALLY (machineId + display), then
+     * consults `remoteOwnerHasLiveSession`:
+     *   true     → genuine move (real duplicate) → dwell→terminate (with Part E bypass).
+     *   false    → owner has no live session → WITHHOLD (neutral once-per-episode audit).
+     *   'unknown'/throw/dep-absent → WITHHOLD (fail-closed; UNKNOWN must NEVER act).
+     * Maps are keyed on the stable TOPIC id (Secondary fix) with the richer streak
+     * struct so the dwell advances only across DISTINCT snapshot generations.
+     */
+    async runCloseoutGated(session, reapedThisTick) {
+        let topicId = null;
+        let owner = null;
+        let pinnedHere = false;
+        try {
+            topicId = this.deps.topicBinding(session.tmuxSession);
+            // The gated path REQUIRES the combined dep — it never falls back to the
+            // display-only one. Absent ⇒ owner stays null ⇒ withhold (fail-closed below).
+            owner = topicId != null ? (this.deps.topicOwnerElsewhereInfo?.(topicId) ?? null) : null;
+            pinnedHere = topicId != null && (this.deps.topicPinnedHere?.(topicId) ?? false);
+        }
+        catch {
+            owner = null; /* @silent-fallback-ok — ownership signal failed → cannot reason → skip rule (safe withhold direction) */
+        }
+        // topicId null → no participation (also covers the topicOwnerElsewhereInfo-absent
+        // dep window: owner is null → the "no owner-elsewhere" reset arm below runs).
+        if (topicId == null)
+            return { terminated: false, reapedThisTick };
+        const key = topicId; // stable topic-keyed breaker state (Secondary fix)
+        const now = this.now();
+        if (owner && pinnedHere) {
+            // Pin-conflict hold WINS ahead of the liveness gate (unchanged WS1.3 rule).
+            const prior = this.topicMovedStreak.get(key);
+            const isHeld = typeof prior === 'object' && prior.kind === 'held';
+            if (!isHeld) {
+                this.audit('reap-skipped-topic-moved', session, { rule: 'topic-moved-away', otherOwner: owner.displayName, skipped: 'pin-conflict-pending-reconcile' });
+            }
+            this.topicMovedStreak.set(key, { kind: 'held', lastSeenAt: now });
+            this.topicMovedVetoes.delete(key);
+            return { terminated: false, reapedThisTick };
+        }
+        if (owner) {
+            // ── Part C: liveness gate ──────────────────────────────────────────────
+            let liveness;
+            try {
+                liveness = this.deps.remoteOwnerHasLiveSession
+                    ? this.deps.remoteOwnerHasLiveSession(topicId, owner.machineId)
+                    : { state: 'unknown' }; // dep absent under gate → fail-closed
+            }
+            catch {
+                liveness = { state: 'unknown' }; // a throw is treated as 'unknown'
+            }
+            if (liveness.state !== true) {
+                // false / 'unknown' → WITHHOLD. Once-per-episode neutral audit + held
+                // sentinel; a withheld episode never accrues breaker vetoes.
+                const prior = this.topicMovedStreak.get(key);
+                const isHeld = typeof prior === 'object' && prior.kind === 'held';
+                if (!isHeld) {
+                    const ownerEntry = liveness.reachableAt;
+                    this.audit('reap-skipped-topic-moved', session, {
+                        rule: 'topic-moved-away',
+                        otherOwner: owner.displayName,
+                        ownerMachineId: owner.machineId,
+                        skipped: liveness.state === false ? 'no-live-remote-session' : 'remote-liveness-unknown',
+                        // Neutral, non-directional observational evidence (NO reconcileToward).
+                        remoteOwnerListedSession: false,
+                        withheldCloseout: true,
+                        possibleStaleOwner: true,
+                        snapshotAgeMs: ownerEntry != null ? now - ownerEntry : undefined,
+                    });
+                }
+                this.topicMovedStreak.set(key, { kind: 'held', lastSeenAt: now });
+                this.topicMovedVetoes.delete(key);
+                return { terminated: false, reapedThisTick };
+            }
+            // state === true: genuine move. Advance the dwell ONLY across a DISTINCT
+            // snapshot generation (reachableAt strictly newer than lastTrueReachableAt).
+            const reachableAt = liveness.reachableAt ?? 0;
+            const prior = this.topicMovedStreak.get(key);
+            let count;
+            let lastTrueReachableAt;
+            if (typeof prior === 'object' && prior.kind === 'counting') {
+                if (reachableAt > prior.lastTrueReachableAt) {
+                    count = prior.count + 1;
+                    lastTrueReachableAt = reachableAt;
+                }
+                else {
+                    // Same generation re-read — the tick does not advance the streak.
+                    count = prior.count;
+                    lastTrueReachableAt = prior.lastTrueReachableAt;
+                }
+            }
+            else {
+                // First counting tick OR transition out of a held (-1) episode → start at 1.
+                count = 1;
+                lastTrueReachableAt = reachableAt;
+            }
+            this.topicMovedStreak.set(key, { kind: 'counting', count, lastTrueReachableAt, lastSeenAt: now });
+            if (count >= this.cfg.topicMovedConfirmTicks) {
+                const reason = `topic moved to ${owner.displayName} — closing the leftover session on this machine (post-transfer closeout)`;
+                // Part E: pass the narrow bypass ONLY when the topic's freshest LOCAL user
+                // message is OLDER than the snapshot reachableAt (freshest-interaction veto).
+                const lastUserMsgAt = (() => {
+                    try {
+                        return this.deps.recentUserMessageAt?.(topicId) ?? null;
+                    }
+                    catch {
+                        return null; /* @silent-fallback-ok — recent-msg signal failed → treat as no recent message → bypass not granted (safe) */
+                    }
+                })();
+                const bypassRecentForMove = lastUserMsgAt == null || lastUserMsgAt <= reachableAt;
+                return this.attemptCloseoutTerminate({
+                    session, otherOwner: owner.displayName, reason, streak: count,
+                    key, reapedThisTick, bypassRecentForMove,
+                    confirmedMove: true, snapshotReachableAt: reachableAt,
+                });
+            }
+            return { terminated: false, reapedThisTick };
+        }
+        // No owner-elsewhere — clear the episode (counting OR held), so a FUTURE move
+        // starts clean. Mirrors the legacy reset arm under the topic key.
+        if (this.topicMovedStreak.has(key)) {
+            this.topicMovedStreak.delete(key);
+            this.topicMovedVetoes.delete(key);
+        }
+        return { terminated: false, reapedThisTick };
+    }
+    /**
+     * Shared closeout terminate machinery — the dwell has been met. Handles the P19
+     * breaker, dry-run, budget caps, the guarded terminate, and the veto/breaker
+     * audit. `key` is session.id (legacy) or the topic id (gated); `bypassRecentForMove`
+     * is passed through to terminate ONLY on a liveness-confirmed genuine move.
+     */
+    async attemptCloseoutTerminate(args) {
+        const { session, otherOwner, reason, streak, key, bypassRecentForMove } = args;
+        let { reapedThisTick } = args;
+        const vetoes = this.topicMovedVetoes.get(key) ?? 0;
+        if (vetoes >= this.cfg.topicMovedVetoBreakerAttempts) {
+            // P19 breaker OPEN — stop retrying for the episode (audited+escalated once).
+            return { terminated: false, reapedThisTick };
+        }
+        if (!this.killsEnabled) {
+            if (streak === this.cfg.topicMovedConfirmTicks) {
+                this.audit('would-reap', session, { rule: 'topic-moved-away', otherOwner, dryRun: true });
+            }
+            return { terminated: false, reapedThisTick };
+        }
+        if (reapedThisTick < this.cfg.maxReapsPerTick && this.hourlyBudgetRemaining() > 0) {
+            const res = await this.deps.terminate(session.id, reason, bypassRecentForMove
+                ? { bypassRecentUserMessageForConfirmedMove: true, workEvidence: [] }
+                : undefined);
+            if (res.terminated) {
+                reapedThisTick++;
+                this.reapTimestamps.push(this.now());
+                this.audit('reaped', session, {
+                    rule: 'topic-moved-away', otherOwner,
+                    ...(args.confirmedMove ? { confirmedMove: true, snapshotReachableAt: args.snapshotReachableAt } : {}),
+                });
+                this.topicMovedStreak.delete(key);
+                this.topicMovedVetoes.delete(key);
+                return { terminated: true, reapedThisTick };
+            }
+            // Guard veto / already-terminal — audit once per streak crossing, keep the
+            // streak so next tick retries (bounded by the breaker).
+            const v = vetoes + 1;
+            this.topicMovedVetoes.set(key, v);
+            if (streak === this.cfg.topicMovedConfirmTicks) {
+                this.audit('reap-skipped-topic-moved', session, { rule: 'topic-moved-away', otherOwner, skipped: res.skipped });
+            }
+            if (v === this.cfg.topicMovedVetoBreakerAttempts) {
+                this.audit('closeout-breaker-open', session, {
+                    rule: 'topic-moved-away', otherOwner, vetoedAttempts: v, lastSkipped: res.skipped ?? 'keep-guard',
+                });
+                const topicId = this.deps.topicBinding(session.tmuxSession);
+                this.deps.raiseAttention?.({
+                    id: `closeout-breaker:${session.id}`,
+                    title: `Topic ${topicId ?? '?'} moved to ${otherOwner}, but the old session won't close`,
+                    summary: `Post-transfer closeout gave up after ${v} vetoed attempts (held by: ${res.skipped ?? 'keep-guard'}).`,
+                    description: `The conversation for topic ${topicId ?? '?'} now lives on ${otherOwner}, but the leftover session on this machine (${session.tmuxSession}) refused to close ${v} times in a row — a KEEP-guard reports it is still working (${res.skipped ?? 'keep-guard'}). Closeout retries have stopped (P19 breaker); the session will close via the normal idle path when it finishes, or you can close it from the dashboard.`,
+                });
+            }
+        }
+        return { terminated: false, reapedThisTick };
+    }
     async tick() {
         if (!this.cfg.enabled || this.running)
             return;
@@ -408,12 +648,54 @@ export class SessionReaper extends EventEmitter {
             for (const id of [...this.busyOrphanStreak.keys()])
                 if (!live.has(id))
                     this.busyOrphanStreak.delete(id);
-            for (const id of [...this.topicMovedStreak.keys()])
-                if (!live.has(id))
-                    this.topicMovedStreak.delete(id);
-            for (const id of [...this.topicMovedVetoes.keys()])
-                if (!live.has(id))
-                    this.topicMovedVetoes.delete(id);
+            if (this.cfg.closeoutLivenessGate) {
+                // Gated: the closeout maps are keyed on the stable TOPIC id, so a naive
+                // "GC any topic without a live session THIS tick" would erase the count
+                // during the brief gap between a session dying and its same-topic respawn
+                // appearing — defeating the topic key. Instead evict a topic entry only
+                // when it has had no live binding AND was not owned-elsewhere for a grace
+                // window (2× tickIntervalSec — survives one full respawn gap). `lastSeenAt`
+                // is stamped on every entry whenever its topic is bound/owned-elsewhere.
+                const liveTopics = new Set();
+                for (const s of sessions) {
+                    const t = this.deps.topicBinding(s.tmuxSession);
+                    if (t != null)
+                        liveTopics.add(t);
+                }
+                const graceMs = 2 * this.cfg.tickIntervalSec * 1000;
+                const now = this.now();
+                for (const [key, val] of [...this.topicMovedStreak.entries()]) {
+                    if (typeof key !== 'number') {
+                        this.topicMovedStreak.delete(key);
+                        continue;
+                    } // stale OFF-mode key
+                    if (liveTopics.has(key))
+                        continue; // still bound — keep
+                    const lastSeen = typeof val === 'object' ? val.lastSeenAt : 0;
+                    if (now - lastSeen > graceMs) {
+                        this.topicMovedStreak.delete(key);
+                        this.topicMovedVetoes.delete(key);
+                    }
+                }
+                // topicMovedVetoes with no streak entry left (and not a live topic) → drop.
+                for (const key of [...this.topicMovedVetoes.keys()]) {
+                    if (typeof key !== 'number') {
+                        this.topicMovedVetoes.delete(key);
+                        continue;
+                    }
+                    if (!liveTopics.has(key) && !this.topicMovedStreak.has(key))
+                        this.topicMovedVetoes.delete(key);
+                }
+            }
+            else {
+                // OFF (legacy): keyed on session.id — GC any id not in the live set.
+                for (const id of [...this.topicMovedStreak.keys()])
+                    if (typeof id === 'number' || !live.has(id))
+                        this.topicMovedStreak.delete(id);
+                for (const id of [...this.topicMovedVetoes.keys()])
+                    if (typeof id === 'number' || !live.has(id))
+                        this.topicMovedVetoes.delete(id);
+            }
             let reapedThisTick = 0;
             for (const session of sessions) {
                 // ── Post-transfer closeout (operator-named issue, 2026-06-05) ──────
@@ -425,94 +707,13 @@ export class SessionReaper extends EventEmitter {
                 // veto is audited and retried next tick (eventual closeout, never a
                 // forced kill). Dwell of `topicMovedConfirmTicks` absorbs ownership
                 // churn mid-transfer.
-                if (this.cfg.topicMovedCloseout && this.deps.topicOwnerElsewhere) {
-                    let otherOwner = null;
-                    let pinnedHere = false;
-                    try {
-                        const topicId = this.deps.topicBinding(session.tmuxSession);
-                        otherOwner = topicId != null ? this.deps.topicOwnerElsewhere(topicId) : null;
-                        // WS1.3 (MULTI-MACHINE-SEAMLESSNESS-SPEC): pin-conflict = do-not-act.
-                        // When the topic's PIN names THIS machine while ownership still says
-                        // another, the divergence is mid-reconcile TOWARD us — the
-                        // OwnershipReconciler is bringing the record back, and closing the
-                        // local session now would kill the exact session the pin wants here
-                        // (the 2026-06-12 incident: the closeout attacked the working laptop
-                        // session every 2 minutes for hours during a stuck transfer-back).
-                        pinnedHere = topicId != null && (this.deps.topicPinnedHere?.(topicId) ?? false);
-                    }
-                    catch {
-                        otherOwner = null; /* signal failed → cannot reason → skip rule */
-                    }
-                    if (otherOwner && pinnedHere) {
-                        // -1 is the held-and-audited sentinel: audit ONCE per conflict
-                        // episode, hold (never act) for as long as the pin names us.
-                        const prior = this.topicMovedStreak.get(session.id) ?? 0;
-                        if (prior !== -1) {
-                            this.audit('reap-skipped-topic-moved', session, { rule: 'topic-moved-away', otherOwner, skipped: 'pin-conflict-pending-reconcile' });
-                            this.topicMovedStreak.set(session.id, -1);
-                        }
-                        // The closeout intent is withdrawn while the pin holds — a fresh
-                        // episode after reconcile starts with a clean breaker.
-                        this.topicMovedVetoes.delete(session.id);
-                    }
-                    else if (otherOwner) {
-                        const streak = (this.topicMovedStreak.get(session.id) ?? 0) + 1;
-                        this.topicMovedStreak.set(session.id, streak);
-                        if (streak >= this.cfg.topicMovedConfirmTicks) {
-                            const reason = `topic moved to ${otherOwner} — closing the leftover session on this machine (post-transfer closeout)`;
-                            const vetoes = this.topicMovedVetoes.get(session.id) ?? 0;
-                            if (vetoes >= this.cfg.topicMovedVetoBreakerAttempts) {
-                                // P19 breaker OPEN (WS1.2): this session vetoed the closeout
-                                // `topicMovedVetoBreakerAttempts` times in a row — stop
-                                // retrying for the episode. NOT a stranded session: it falls
-                                // through to the idle pipeline below every tick, so it is
-                                // still reaped normally when its work actually finishes. The
-                                // open transition was audited + escalated exactly once.
-                            }
-                            else if (!this.killsEnabled) {
-                                if (streak === this.cfg.topicMovedConfirmTicks) {
-                                    this.audit('would-reap', session, { rule: 'topic-moved-away', otherOwner, dryRun: true });
-                                }
-                            }
-                            else if (reapedThisTick < this.cfg.maxReapsPerTick && this.hourlyBudgetRemaining() > 0) {
-                                const res = await this.deps.terminate(session.id, reason);
-                                if (res.terminated) {
-                                    reapedThisTick++;
-                                    this.reapTimestamps.push(this.now());
-                                    this.audit('reaped', session, { rule: 'topic-moved-away', otherOwner });
-                                    this.topicMovedStreak.delete(session.id);
-                                    this.topicMovedVetoes.delete(session.id);
-                                    continue; // session is gone — skip the idle pipeline
-                                }
-                                // Guard veto / already-terminal — audit once per streak crossing,
-                                // keep the streak so next tick retries (bounded by the breaker).
-                                const v = vetoes + 1;
-                                this.topicMovedVetoes.set(session.id, v);
-                                if (streak === this.cfg.topicMovedConfirmTicks) {
-                                    this.audit('reap-skipped-topic-moved', session, { rule: 'topic-moved-away', otherOwner, skipped: res.skipped });
-                                }
-                                if (v === this.cfg.topicMovedVetoBreakerAttempts) {
-                                    // Breaker opens NOW: one audit row + one deduped escalation.
-                                    this.audit('closeout-breaker-open', session, {
-                                        rule: 'topic-moved-away', otherOwner, vetoedAttempts: v, lastSkipped: res.skipped ?? 'keep-guard',
-                                    });
-                                    const topicId = this.deps.topicBinding(session.tmuxSession);
-                                    this.deps.raiseAttention?.({
-                                        id: `closeout-breaker:${session.id}`,
-                                        title: `Topic ${topicId ?? '?'} moved to ${otherOwner}, but the old session won't close`,
-                                        summary: `Post-transfer closeout gave up after ${v} vetoed attempts (held by: ${res.skipped ?? 'keep-guard'}).`,
-                                        description: `The conversation for topic ${topicId ?? '?'} now lives on ${otherOwner}, but the leftover session on this machine (${session.tmuxSession}) refused to close ${v} times in a row — a KEEP-guard reports it is still working (${res.skipped ?? 'keep-guard'}). Closeout retries have stopped (P19 breaker); the session will close via the normal idle path when it finishes, or you can close it from the dashboard.`,
-                                    });
-                                }
-                            }
-                        }
-                    }
-                    else if ((this.topicMovedStreak.get(session.id) ?? 0) !== 0) {
-                        // Clears both a counting streak AND the -1 pin-conflict sentinel,
-                        // so a FUTURE genuine move starts its dwell from a clean slate.
-                        this.topicMovedStreak.set(session.id, 0);
-                        this.topicMovedVetoes.delete(session.id);
-                    }
+                if (this.cfg.topicMovedCloseout && (this.deps.topicOwnerElsewhere || this.deps.topicOwnerElsewhereInfo)) {
+                    const outcome = this.cfg.closeoutLivenessGate
+                        ? await this.runCloseoutGated(session, reapedThisTick)
+                        : await this.runCloseoutLegacy(session, reapedThisTick);
+                    reapedThisTick = outcome.reapedThisTick;
+                    if (outcome.terminated)
+                        continue; // session is gone — skip the idle pipeline
                 }
                 // CPU-progress probe for the active-process keep-tightening. Sampled here
                 // (once per session per tick) so the cross-tick delta lives in one place;