instar 1.3.728 → 1.3.730

package/dist/core/SessionOwnershipRegistry.d.ts

@@ -30,6 +30,11 @@ import { type OwnershipAction, type OwnershipReason, type SessionOwnershipRecord
  */
 export declare class InMemorySessionOwnershipStore {
     private recs;
+    /** Interface-level commit hook (standby-write-reconciliation §3.2, round-2
+     *  S4): fired at THIS substrate's own mutation point (`casWrite` — it has no
+     *  `persist()` funnel), so a WriteAdmission ownership index warmed against
+     *  this store is never warm-once-then-permanently-stale. */
+    onCommit?: (record: import('./SessionOwnership.js').SessionOwnershipRecord) => void;
     read(sessionKey: string): SessionOwnershipRecord | null;
     casWrite(candidate: import('./SessionOwnership.js').SessionOwnershipRecord): {
         ok: boolean;
@@ -57,6 +62,17 @@ export interface SessionOwnershipStore {
      * implement it.
      */
     all?(): SessionOwnershipRecord[];
+    /**
+     * Interface-level commit hook (standby-write-reconciliation §3.2, round-2
+     * S4): assignable listener each substrate fires at its OWN mutation point —
+     * `LocalSessionOwnershipStore` inside `persist()` (after `cache.set`),
+     * `InMemorySessionOwnershipStore` inside `casWrite()` at its `recs.set`.
+     * BOTH mutation paths (`registry.cas()` and `OwnershipApplier`) funnel
+     * through the store's commit point, so a consumer (the WriteAdmission
+     * ownership index) can never miss a transition the local store saw.
+     * A listener throw must never fail the CAS (substrates guard the call).
+     */
+    onCommit?: (record: SessionOwnershipRecord) => void;
 }
 export interface SessionOwnershipRegistryDeps {
     store: SessionOwnershipStore;

package/dist/core/SessionOwnershipRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SessionOwnershipRegistry.d.ts","sourceRoot":"","sources":["../../src/core/SessionOwnershipRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;GAOG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,IAAI,CAA6E;IACzF,IAAI,CAAC,UAAU,EAAE,MAAM;IAGvB,QAAQ,CAAC,SAAS,EAAE,OAAO,uBAAuB,EAAE,sBAAsB;;;;IAe1E,GAAG;CAGJ;AAED,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB;IACpC,sEAAsE;IACtE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAAC;IACxD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,sBAAsB,GAAG;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAAA;KAAE,CAAC;IACtG;;;;;OAKG;IACH,GAAG,CAAC,IAAI,sBAAsB,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,qBAAqB,CAAC;IAC7B,2DAA2D;IAC3D,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACpC,4EAA4E;IAC5E,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,wEAAwE;IACxE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9C,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,MAAM,SAAS,GACjB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,GAC5C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,GAAG,gBAAgB,GAAG,UAAU,CAAC;IAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAAA;CAAE,CAAC;AAEpH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAA+B;IACjD,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,mBAAmB,CAAK;gBAEpB,IAAI,EAAE,4BAA4B;IAG9C,OAAO,CAAC,GAAG;IAIX,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI;IAIvD;;;;;OAKG;IACH,GAAG,IAAI,sBAAsB,EAAE;IAI/B,wEAAwE;IACxE,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAM1C;;;OAGG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAQpD;;;;;;OAMG;IACH,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS;IAuBnG,2FAA2F;IAC3F,mBAAmB,IAAI,IAAI;IAG3B,OAAO,IAAI;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE;CAGjE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,EACrB,kBAAkB,EAAE,MAAM,EAC1B,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7C,MAAM,CAOR"}
+{"version":3,"file":"SessionOwnershipRegistry.d.ts","sourceRoot":"","sources":["../../src/core/SessionOwnershipRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;GAOG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,IAAI,CAA6E;IACzF;;;gEAG4D;IAC5D,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,uBAAuB,EAAE,sBAAsB,KAAK,IAAI,CAAC;IACpF,IAAI,CAAC,UAAU,EAAE,MAAM;IAGvB,QAAQ,CAAC,SAAS,EAAE,OAAO,uBAAuB,EAAE,sBAAsB;;;;IAsB1E,GAAG;CAGJ;AAED,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB;IACpC,sEAAsE;IACtE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAAC;IACxD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,sBAAsB,GAAG;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAAA;KAAE,CAAC;IACtG;;;;;OAKG;IACH,GAAG,CAAC,IAAI,sBAAsB,EAAE,CAAC;IACjC;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,sBAAsB,KAAK,IAAI,CAAC;CACrD;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,qBAAqB,CAAC;IAC7B,2DAA2D;IAC3D,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACpC,4EAA4E;IAC5E,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,wEAAwE;IACxE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9C,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,MAAM,SAAS,GACjB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,GAC5C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,GAAG,gBAAgB,GAAG,UAAU,CAAC;IAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAAA;CAAE,CAAC;AAEpH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAA+B;IACjD,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,mBAAmB,CAAK;gBAEpB,IAAI,EAAE,4BAA4B;IAG9C,OAAO,CAAC,GAAG;IAIX,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI;IAIvD;;;;;OAKG;IACH,GAAG,IAAI,sBAAsB,EAAE;IAI/B,wEAAwE;IACxE,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAM1C;;;OAGG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAQpD;;;;;;OAMG;IACH,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS;IAuBnG,2FAA2F;IAC3F,mBAAmB,IAAI,IAAI;IAG3B,OAAO,IAAI;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE;CAGjE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,EACrB,kBAAkB,EAAE,MAAM,EAC1B,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7C,MAAM,CAOR"}

package/dist/core/SessionOwnershipRegistry.js

@@ -30,6 +30,11 @@ import { applyOwnershipAction, ownershipNonceKey, } from './SessionOwnership.js'
  */
 export class InMemorySessionOwnershipStore {
     recs = new Map();
+    /** Interface-level commit hook (standby-write-reconciliation §3.2, round-2
+     *  S4): fired at THIS substrate's own mutation point (`casWrite` — it has no
+     *  `persist()` funnel), so a WriteAdmission ownership index warmed against
+     *  this store is never warm-once-then-permanently-stale. */
+    onCommit;
     read(sessionKey) {
         return this.recs.get(sessionKey) ?? null;
     }
@@ -44,6 +49,14 @@ export class InMemorySessionOwnershipStore {
         // and proposes an epoch ≤ the landed one).
         if (candidate.ownershipEpoch > curEpoch) {
             this.recs.set(candidate.sessionKey, candidate);
+            try {
+                this.onCommit?.(candidate);
+            }
+            catch {
+                /* @silent-fallback-ok — the commit hook is an observability consumer
+                   (WriteAdmission ownership index); a listener throw must never fail the
+                   ownership CAS itself. The index's own ingest never throws by design. */
+            }
             return { ok: true, observed: candidate };
         }
         return { ok: false, observed: current };

package/dist/core/SessionOwnershipRegistry.js.map

@@ -1 +1 @@
-{"version":3,"file":"SessionOwnershipRegistry.js","sourceRoot":"","sources":["../../src/core/SessionOwnershipRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,oBAAoB,EACpB,iBAAiB,GAIlB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;GAOG;AACH,MAAM,OAAO,6BAA6B;IAChC,IAAI,GAAG,IAAI,GAAG,EAAkE,CAAC;IACzF,IAAI,CAAC,UAAkB;QACrB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;IAC3C,CAAC;IACD,QAAQ,CAAC,SAAiE;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;QAC5D,MAAM,QAAQ,GAAG,OAAO,EAAE,cAAc,IAAI,CAAC,CAAC;QAC9C,4EAA4E;QAC5E,0EAA0E;QAC1E,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,2CAA2C;QAC3C,IAAI,SAAS,CAAC,cAAc,GAAG,QAAQ,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YAC/C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC1C,CAAC;IACD,GAAG;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACjC,CAAC;CACF;AA6CD,MAAM,OAAO,wBAAwB;IAClB,CAAC,CAA+B;IACzC,YAAY,GAAG,CAAC,CAAC;IACjB,mBAAmB,GAAG,CAAC,CAAC;IAEhC,YAAY,IAAkC;QAC5C,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAChB,CAAC;IACO,GAAG;QACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,CAAC;IAED,IAAI,CAAC,UAAkB;QACrB,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,GAAG;QACD,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC;IAED,wEAAwE;IACxE,OAAO,CAAC,UAAkB;QACxB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;QAC/C,OAAO,CAAC,CAAC,cAAc,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,UAAkB;QAClC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,cAAc,CAAC;QACpD,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc;YAAE,OAAO,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACH,GAAG,CAAC,MAAuB,EAAE,GAA0D;QACrF,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC,CAAC,mNAAmN;QAC7N,CAAC;QACD,MAAM,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAC/H,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAErE,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7F,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAE9F,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,4BAA4B,GAAG,CAAC,UAAU,qBAAqB,GAAG,CAAC,QAAQ,EAAE,cAAc,IAAI,CAAC,EAAE,CAAC,CAAC;YACpH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC;IAED,2FAA2F;IAC3F,mBAAmB;QACjB,IAAI,CAAC,mBAAmB,EAAE,CAAC;IAC7B,CAAC;IACD,OAAO;QACL,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC;IAC5F,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAkB,EAClB,aAAqB,EACrB,kBAA0B,EAC1B,OAA4C,EAAE;IAE9C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC;IACvE,mFAAmF;IACnF,MAAM,SAAS,GAAG,aAAa,GAAG,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IACzF,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"SessionOwnershipRegistry.js","sourceRoot":"","sources":["../../src/core/SessionOwnershipRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,oBAAoB,EACpB,iBAAiB,GAIlB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;GAOG;AACH,MAAM,OAAO,6BAA6B;IAChC,IAAI,GAAG,IAAI,GAAG,EAAkE,CAAC;IACzF;;;gEAG4D;IAC5D,QAAQ,CAA4E;IACpF,IAAI,CAAC,UAAkB;QACrB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;IAC3C,CAAC;IACD,QAAQ,CAAC,SAAiE;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;QAC5D,MAAM,QAAQ,GAAG,OAAO,EAAE,cAAc,IAAI,CAAC,CAAC;QAC9C,4EAA4E;QAC5E,0EAA0E;QAC1E,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,2CAA2C;QAC3C,IAAI,SAAS,CAAC,cAAc,GAAG,QAAQ,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YAC/C,IAAI,CAAC;gBACH,IAAI,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP;;0FAE0E;YAC5E,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC1C,CAAC;IACD,GAAG;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACjC,CAAC;CACF;AAwDD,MAAM,OAAO,wBAAwB;IAClB,CAAC,CAA+B;IACzC,YAAY,GAAG,CAAC,CAAC;IACjB,mBAAmB,GAAG,CAAC,CAAC;IAEhC,YAAY,IAAkC;QAC5C,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAChB,CAAC;IACO,GAAG;QACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,CAAC;IAED,IAAI,CAAC,UAAkB;QACrB,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,GAAG;QACD,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC;IAED,wEAAwE;IACxE,OAAO,CAAC,UAAkB;QACxB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;QAC/C,OAAO,CAAC,CAAC,cAAc,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,UAAkB;QAClC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,cAAc,CAAC;QACpD,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc;YAAE,OAAO,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACH,GAAG,CAAC,MAAuB,EAAE,GAA0D;QACrF,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC,CAAC,mNAAmN;QAC7N,CAAC;QACD,MAAM,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAC/H,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAErE,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7F,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAE9F,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,4BAA4B,GAAG,CAAC,UAAU,qBAAqB,GAAG,CAAC,QAAQ,EAAE,cAAc,IAAI,CAAC,EAAE,CAAC,CAAC;YACpH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC;IAED,2FAA2F;IAC3F,mBAAmB;QACjB,IAAI,CAAC,mBAAmB,EAAE,CAAC;IAC7B,CAAC;IACD,OAAO;QACL,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC;IAC5F,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAkB,EAClB,aAAqB,EACrB,kBAA0B,EAC1B,OAA4C,EAAE;IAE9C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC;IACvE,mFAAmF;IACnF,MAAM,SAAS,GAAG,aAAa,GAAG,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IACzF,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AAClC,CAAC"}

package/dist/core/SessionRefresh.d.ts

@@ -35,6 +35,7 @@ import type { SessionManager } from './SessionManager.js';
 import type { StateManager } from './StateManager.js';
 import type { TelegramAdapter } from '../messaging/TelegramAdapter.js';
 import type { TopicResumeMap } from './TopicResumeMap.js';
+import { type MitigationInbound, type SwapWorkGateCallerClass, type WorkProbeResult } from './SwapWorkGate.js';
 export declare function ensureResumeTranscriptInConfigHome(uuid: string, targetConfigHome: string): boolean;
 export interface SessionRefreshDeps {
     sessionManager: SessionManager;
@@ -82,12 +83,73 @@ export interface SessionRefreshDeps {
         maxPerWindow: number;
         windowMs: number;
     };
+    /**
+     * swap-continuity-antithrash §4.2 — the in-flight work gate, bound at THIS
+     * primitive (the one funnel every session-killing account/model/refresh
+     * mutation flows through). Constructor-injected on purpose: §7.1 marks
+     * `swapContinuity.enabled` restart-required; the numeric knobs + dryRun are
+     * read live via `getKnobs`. Absent/null ⇒ byte-for-byte today's behavior.
+     */
+    workGateCtx?: SwapContinuityGateContext | null;
     /** Injectable clock for tests. Defaults to Date.now. */
     clock?: () => number;
 }
+/** The work-gate context SessionRefresh consumes (§4.2/§4.3/§4.5). */
+export interface SwapContinuityGateContext {
+    /** SwapWorkGate.probe — the stateless busy predicate. */
+    probe: (tmuxSession: string) => Promise<WorkProbeResult>;
+    /** Live knobs (dryRun + grace bounds read per evaluation, §7.1). */
+    getKnobs: () => {
+        enabled: boolean;
+        dryRun: boolean;
+        reactiveGraceMs: number;
+        recheckMs: number;
+    };
+    /** Swap-ledger hooks (optional — present when the anti-thrash engine is wired). */
+    recordProceeded?: (args: {
+        session: string;
+        kind: 'reactive' | 'interactive';
+        callerClass: string;
+        nowMs: number;
+        from: string;
+        to?: string;
+        reason: 'busy-turn' | 'busy-subagents' | 'busy-indeterminate';
+        inFlight: {
+            turn: boolean;
+            subagents: number;
+        };
+        subagentLeg: 'ok' | 'absent' | 'indeterminate';
+        killedSubagents?: number;
+        killedSubagentList?: Array<{
+            agentType: string;
+            ageMinutes: number;
+            transcriptPath?: string;
+        }>;
+        inbound: 'reinjected' | 'none' | 'unknown';
+        force?: boolean;
+    }) => void;
+    recordInteractiveRefusal?: (args: {
+        session: string;
+        nowMs: number;
+        inFlight: {
+            turn: boolean;
+            subagents: number;
+        };
+        subagentLeg: 'ok' | 'absent' | 'indeterminate';
+    }) => void;
+    /** §4.3(2) — the last unanswered inbound for a topic (Q4: in-memory map in
+     *  v1; 'unknown' = map unavailable / post-restart). */
+    resolveUnansweredInbound?: (topicId: number) => MitigationInbound | 'none' | 'unknown';
+    /** Injectable sleep for tests (grace-loop pacing). */
+    wait?: (ms: number) => Promise<void>;
+}
 export type RefreshResult = {
     ok: true;
     newSessionName: string;
+    /** §4.3 — this refresh proceeded OVER busy work with the mitigation
+     *  payload attached (reactive-after-grace or force). Lets the swap
+     *  orchestration avoid double-recording (the proceeded row is written). */
+    proceededOverBusy?: boolean;
     /** Telegram topic id, or (Slack) the stable NEGATIVE synthetic id —
      *  same hash the rest of the system uses to bridge Slack channels into
      *  numeric topic space. Kept required for back-compat consumers. */
@@ -101,8 +163,18 @@ export type RefreshResult = {
     ok: false;
     code: RefreshFailureCode;
     message: string;
+    /** §4.5 session-busy refusal payload (counts and ages only — no titles,
+     *  no transcript paths, no message content on the wire). */
+    turnInFlight?: boolean;
+    subagents?: Array<{
+        agentType: string;
+        ageMinutes: number;
+    }>;
+    /** 'absent' = no readable claudeSessionId (R5-M1) — `subagents` is then
+     *  OMITTED: unreadable is never rendered as an empty list. */
+    subagentLeg?: 'absent' | 'indeterminate';
 };
-export type RefreshFailureCode = 'rate_limited' | 'session_not_found' | 'not_telegram_bound' | 'no_telegram_adapter' | 'slack_respawner_unwired' | 'refresh_in_progress';
+export type RefreshFailureCode = 'rate_limited' | 'session_not_found' | 'not_telegram_bound' | 'no_telegram_adapter' | 'slack_respawner_unwired' | 'refresh_in_progress' | 'session-busy';
 export interface RefreshOptions {
     sessionName: string;
     followUpPrompt?: string;
@@ -128,6 +200,20 @@ export interface RefreshOptions {
      */
     configHome?: string;
     accountId?: string;
+    /**
+     * swap-continuity-antithrash §4.2 — the work-gate caller class. Set ONLY by
+     * server-internal call sites (invariant I11 — no route ever populates it
+     * from request input; a wire-derived 'recovery' would be a gate bypass by
+     * construction). Absent/unlisted callers default to 'interactive-refresh'
+     * (the safest class: nothing is killed, the caller is told why).
+     */
+    callerClass?: SwapWorkGateCallerClass;
+    /**
+     * §4.5 — interactive override of the work gate ONLY (never the rate guard).
+     * Bearer-level authority, recorded as such in the ledger. A `force` over
+     * busy work proceeds WITH the §4.3 mitigation payload attached.
+     */
+    force?: boolean;
 }
 export declare class SessionRefresh {
     private readonly deps;
@@ -152,6 +238,35 @@ export declare class SessionRefresh {
      * unexpected internal errors from the respawner callback.
      */
     refreshSession(opts: RefreshOptions): Promise<RefreshResult>;
+    /**
+     * The §4.2 work-gate consult. Returns:
+     *  - `{}`                          — proceed normally (gate absent/dark/idle/dry-run/recovery)
+     *  - `{ refusal }`                 — structured refusal (nothing killed)
+     *  - `{ mitigationBlock }`         — proceed OVER busy work with the §4.3
+     *                                    mitigation payload (reactive-after-grace or force)
+     */
+    private consultWorkGate;
+    /**
+     * §4.5 pre-202 interactive busy precheck — lets `/sessions/refresh` answer
+     * the truth SYNCHRONOUSLY (HTTP 409 `session-busy`) instead of
+     * accepting-then-failing. Returns null when the gate is absent/dark/dry-run
+     * or the session is idle (the route then 202s and schedules the refresh; the
+     * in-funnel gate remains the authority for the raced window). A busy verdict
+     * records the §6.1 interactive refusal row.
+     */
+    precheckInteractiveBusy(sessionName: string): Promise<{
+        turnInFlight: boolean;
+        subagents?: Array<{
+            agentType: string;
+            ageMinutes: number;
+        }>;
+        subagentLeg?: 'absent' | 'indeterminate';
+        message: string;
+    } | null>;
+    /** Build + record the §4.3 mitigation payload. Additive to the respawn and
+     *  never gates it — a failure here logs and proceeds (the kill is already
+     *  justified when we reach here; the mitigation must not become a new wedge). */
+    private buildMitigation;
     /**
      * Returns true if a fresh refresh is allowed under the rolling window cap.
      * Pure read of the recent-refresh ledger; does not mutate.

package/dist/core/SessionRefresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SessionRefresh.d.ts","sourceRoot":"","sources":["../../src/core/SessionRefresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA2B1D,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CA8BlG;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,cAAc,CAAC;IAC/B,KAAK,EAAE,YAAY,CAAC;IACpB,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;IACjC,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC;;;;;;;;;;;;;;OAcG;IACH,SAAS,EAAE,CACT,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,MAAM,GAAG,SAAS;IAClC;8EAC0E;IAC1E,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KACtD,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC,6EAA6E;IAC7E,SAAS,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,aAAa,GACrB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,cAAc,EAAE,MAAM,CAAC;IACvB;;wEAEoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB;iEAC6D;IAC7D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,yEAAyE;IACzE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7D,MAAM,MAAM,kBAAkB,GAC1B,cAAc,GACd,mBAAmB,GACnB,oBAAoB,GACpB,qBAAqB,GACrB,yBAAyB,GACzB,qBAAqB,CAAC;AAE1B,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAKD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;IAC1C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IACpE;;oDAEgD;IAChD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0B;gBAEvC,IAAI,EAAE,kBAAkB;IAOpC;;;;;;;;;;OAUG;IACG,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IA0MlE;;;OAGG;IACH,OAAO,CAAC,cAAc;IAWtB,iEAAiE;IACjE,OAAO,CAAC,aAAa;IAOrB;;;;OAIG;IACH,OAAO,CAAC,YAAY;CAKrB"}
+{"version":3,"file":"SessionRefresh.d.ts","sourceRoot":"","sources":["../../src/core/SessionRefresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAEL,KAAK,iBAAiB,EAEtB,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AA2B3B,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CA8BlG;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,cAAc,CAAC;IAC/B,KAAK,EAAE,YAAY,CAAC;IACpB,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;IACjC,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC;;;;;;;;;;;;;;OAcG;IACH,SAAS,EAAE,CACT,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,MAAM,GAAG,SAAS;IAClC;8EAC0E;IAC1E,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KACtD,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC,6EAA6E;IAC7E,SAAS,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC/C,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB;AAED,sEAAsE;AACtE,MAAM,WAAW,yBAAyB;IACxC,yDAAyD;IACzD,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IACzD,oEAAoE;IACpE,QAAQ,EAAE,MAAM;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAClG,mFAAmF;IACnF,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,UAAU,GAAG,aAAa,CAAC;QACjC,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,WAAW,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;QAC9D,QAAQ,EAAE;YAAE,IAAI,EAAE,OAAO,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;QAC/C,WAAW,EAAE,IAAI,GAAG,QAAQ,GAAG,eAAe,CAAC;QAC/C,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,kBAAkB,CAAC,EAAE,KAAK,CAAC;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAC;YAAC,cAAc,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC/F,OAAO,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAAC;QAC3C,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,KAAK,IAAI,CAAC;IACX,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE;QAChC,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE;YAAE,IAAI,EAAE,OAAO,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;QAC/C,WAAW,EAAE,IAAI,GAAG,QAAQ,GAAG,eAAe,CAAC;KAChD,KAAK,IAAI,CAAC;IACX;2DACuD;IACvD,wBAAwB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,iBAAiB,GAAG,MAAM,GAAG,SAAS,CAAC;IACvF,sDAAsD;IACtD,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC;AAED,MAAM,MAAM,aAAa,GACrB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,cAAc,EAAE,MAAM,CAAC;IACvB;;+EAE2E;IAC3E,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;wEAEoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB;iEAC6D;IAC7D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,yEAAyE;IACzE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB;gEAC4D;IAC5D,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D;kEAC8D;IAC9D,WAAW,CAAC,EAAE,QAAQ,GAAG,eAAe,CAAC;CAC1C,CAAC;AAEN,MAAM,MAAM,kBAAkB,GAC1B,cAAc,GACd,mBAAmB,GACnB,oBAAoB,GACpB,qBAAqB,GACrB,yBAAyB,GACzB,qBAAqB,GAGrB,cAAc,CAAC;AAEnB,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,uBAAuB,CAAC;IACtC;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAKD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;IAC1C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IACpE;;oDAEgD;IAChD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0B;gBAEvC,IAAI,EAAE,kBAAkB;IAOpC;;;;;;;;;;OAUG;IACG,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IA+NlE;;;;;;OAMG;YACW,eAAe;IAsH7B;;;;;;;OAOG;IACG,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAC1D,YAAY,EAAE,OAAO,CAAC;QACtB,SAAS,CAAC,EAAE,KAAK,CAAC;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC7D,WAAW,CAAC,EAAE,QAAQ,GAAG,eAAe,CAAC;QACzC,OAAO,EAAE,MAAM,CAAC;KACjB,GAAG,IAAI,CAAC;IA2DT;;qFAEiF;IACjF,OAAO,CAAC,eAAe;IAwDvB;;;OAGG;IACH,OAAO,CAAC,cAAc;IAWtB,iEAAiE;IACjE,OAAO,CAAC,aAAa;IAOrB;;;;OAIG;IACH,OAAO,CAAC,YAAY;CAKrB"}

package/dist/core/SessionRefresh.js

@@ -34,6 +34,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { ensureInteractiveReady } from './ensureInteractiveReady.js';
 import { slackConversationKey, slackRoutingKeySyntheticId, } from './slackRefreshBinding.js';
+import { buildMitigationPayload, } from './SwapWorkGate.js';
 /**
  * Account-swap conversation continuity. Claude stores conversation transcripts
  * PER CONFIG HOME (`<CLAUDE_CONFIG_DIR>/projects/<projectDir>/<uuid>.jsonl`), so a
@@ -204,22 +205,43 @@ export class SessionRefresh {
                 message: `A refresh is already in progress for "${sessionName}".`,
             };
         }
-        // ── rate guard ─────────────────────────────────────────────────────
-        if (!this.checkRateLimit(sessionName)) {
-            this.logRateLimit(sessionName, reason);
-            return {
-                ok: false,
-                code: 'rate_limited',
-                message: `Refresh rate limit exceeded (${this.maxPerWindow} per ${Math.round(this.windowMs / 60000)} minutes) for session "${sessionName}".`,
-            };
-        }
-        // ── attempt ────────────────────────────────────────────────────────
-        // Record the attempt against the rate guard window BEFORE the work —
-        // we count attempts, not successes, so a flapping respawner can't
-        // bypass the cap. Also mark in-flight so a parallel call refuses.
-        this.recordRefresh(sessionName);
+        // Mark in-flight BEFORE the work gate: the reactive grace loop can hold
+        // this call open for up to reactiveGraceMs, and a parallel refresh racing
+        // through that window must refuse rather than double-kill.
         this.inFlight.add(sessionName);
+        let followUpWithMitigations = followUpPrompt;
+        let proceededOverBusy = false;
         try {
+            // ── work gate (swap-continuity-antithrash §4.2) — BEFORE the rate
+            // guard: a deferred or refused attempt consumes ZERO rate budget,
+            // otherwise a busy session's own deferrals would exhaust the budget
+            // and starve the eventual legitimate swap. ──
+            const gate = await this.consultWorkGate(opts, stateSession, topicId);
+            if (gate.refusal)
+                return gate.refusal;
+            if (gate.mitigationBlock !== undefined) {
+                proceededOverBusy = true;
+                if (gate.mitigationBlock.length > 0) {
+                    followUpWithMitigations = [followUpPrompt, gate.mitigationBlock]
+                        .filter((s) => !!s && s.length > 0)
+                        .join('\n\n');
+                }
+            }
+            // ── rate guard ───────────────────────────────────────────────────
+            if (!this.checkRateLimit(sessionName)) {
+                this.logRateLimit(sessionName, reason);
+                return {
+                    ok: false,
+                    code: 'rate_limited',
+                    message: `Refresh rate limit exceeded (${this.maxPerWindow} per ${Math.round(this.windowMs / 60000)} minutes) for session "${sessionName}".`,
+                };
+            }
+            // ── attempt ──────────────────────────────────────────────────────
+            // Record the attempt against the rate guard window BEFORE the work —
+            // we count attempts, not successes, so a flapping respawner can't
+            // bypass the cap. (`force` overrides ONLY the work gate, never the
+            // rate guard — a forced refresh still consumes rate budget, §4.5.)
+            this.recordRefresh(sessionName);
             // Kill via sessionManager so the beforeSessionKill listener fires
             // and persists the resume UUID using session.claudeSessionId. This
             // replaces the previous SessionRefresh-side findUuidForSession+save
@@ -284,7 +306,7 @@ export class SessionRefresh {
             // then re-register the routing-key → session binding. Guarded non-null
             // by the slack_respawner_unwired refusal in detect.
             if (topicId === null && slackRoutingKey !== null) {
-                const newSessionName = await this.deps.slackRespawner(sessionName, slackRoutingKey, followUpPrompt, accountSwap);
+                const newSessionName = await this.deps.slackRespawner(sessionName, slackRoutingKey, followUpWithMitigations, accountSwap);
                 const conversationKey = slackConversationKey(slackRoutingKey);
                 // ── verify + finalize (Slack) ──────────────────────────────────
                 console.log(`[SessionRefresh] Refreshed "${sessionName}" → "${newSessionName}" (${conversationKey})${reason ? ` reason="${reason}"` : ''}`);
@@ -294,17 +316,258 @@ export class SessionRefresh {
                     topicId: slackRoutingKeySyntheticId(slackRoutingKey),
                     platform: 'slack',
                     conversationKey,
+                    ...(proceededOverBusy ? { proceededOverBusy: true } : {}),
                 };
             }
-            const newSessionName = await this.deps.respawner(sessionName, topicId, followUpPrompt, accountSwap);
+            const newSessionName = await this.deps.respawner(sessionName, topicId, followUpWithMitigations, accountSwap);
             // ── verify + finalize ────────────────────────────────────────────
             console.log(`[SessionRefresh] Refreshed "${sessionName}" → "${newSessionName}" (topic ${topicId})${reason ? ` reason="${reason}"` : ''}`);
-            return { ok: true, newSessionName, topicId: topicId };
+            return { ok: true, newSessionName, topicId: topicId, ...(proceededOverBusy ? { proceededOverBusy: true } : {}) };
         }
         finally {
             this.inFlight.delete(sessionName);
         }
     }
+    /**
+     * The §4.2 work-gate consult. Returns:
+     *  - `{}`                          — proceed normally (gate absent/dark/idle/dry-run/recovery)
+     *  - `{ refusal }`                 — structured refusal (nothing killed)
+     *  - `{ mitigationBlock }`         — proceed OVER busy work with the §4.3
+     *                                    mitigation payload (reactive-after-grace or force)
+     */
+    async consultWorkGate(opts, stateSession, topicId) {
+        const ctx = this.deps.workGateCtx;
+        if (!ctx)
+            return {};
+        let knobs;
+        try {
+            knobs = ctx.getKnobs();
+        }
+        catch {
+            // @silent-fallback-ok: a broken knob getter reads as gate-dark — the
+            // work gate is ADDITIVE and must never block a refresh (§4.5).
+            return {};
+        }
+        if (!knobs.enabled)
+            return {};
+        const callerClass = opts.callerClass ?? 'interactive-refresh';
+        // Recovery is EXEMPT by explicit class (§4.2): the session is wedged, its
+        // "work" is not progressing; gating recovery on a broken pane's
+        // indicators would deadlock recovery.
+        if (callerClass === 'recovery')
+            return {};
+        let probe;
+        try {
+            probe = await ctx.probe(opts.sessionName);
+        }
+        catch {
+            // @silent-fallback-ok: probe machinery itself failed — I7: uncertainty
+            // resolves BUSY, the safe direction (the refresh is refused/deferred,
+            // never a wrong kill); the refusal itself is the loud surface.
+            probe = {
+                busy: true,
+                turnLeg: 'indeterminate',
+                subagentLeg: 'indeterminate',
+                turnInFlight: false,
+                subagents: null,
+                reason: 'busy-indeterminate',
+            };
+        }
+        if (!probe.busy)
+            return {};
+        const busyReason = probe.reason ?? 'busy-indeterminate';
+        if (knobs.dryRun) {
+            // Rung-2 soak: log the would-decision, change nothing.
+            const would = callerClass === 'proactive-swap' ? 'WOULD-DEFER' : callerClass === 'reactive-swap' || opts.force ? 'WOULD-MITIGATE' : 'WOULD-REFUSE';
+            console.log(`[SwapWorkGate] ${would} session=${opts.sessionName} caller=${callerClass} reason=${busyReason} (dryRun — no behavior change)`);
+            return {};
+        }
+        if (callerClass === 'proactive-swap') {
+            // The monitor owns the deferral lifecycle; the funnel's job is that
+            // nothing is killed. The structured refusal reads as "defer" upstream.
+            return {
+                refusal: {
+                    ok: false,
+                    code: 'session-busy',
+                    message: `Session "${opts.sessionName}" has in-flight work (${busyReason}) — proactive swap deferred, retried next tick.`,
+                },
+            };
+        }
+        if (callerClass === 'interactive-refresh' && !opts.force) {
+            // §4.5 pre-202 structured refusal — the caller decides: wait, or
+            // re-issue with force:true. Counts and ages only on the wire.
+            try {
+                ctx.recordInteractiveRefusal?.({
+                    session: opts.sessionName,
+                    nowMs: this.clock(),
+                    inFlight: { turn: probe.turnInFlight, subagents: probe.subagents?.length ?? 0 },
+                    subagentLeg: probe.subagentLeg,
+                });
+            }
+            catch {
+                /* ledger hooks are additive — never block the refusal itself */
+            }
+            const refusal = {
+                ok: false,
+                code: 'session-busy',
+                message: `Session "${opts.sessionName}" has in-flight work (${busyReason}). Wait for it to land, or re-issue with force:true (the kill then carries the mitigation payload).`,
+                turnInFlight: probe.turnInFlight,
+            };
+            if (probe.subagentLeg === 'ok') {
+                // agentType + ageMinutes only — never titles/paths/content (§4.5).
+                refusal.subagents = (probe.subagents ?? []).map((s) => ({ agentType: s.agentType, ageMinutes: s.ageMinutes }));
+            }
+            else {
+                // Unreadable is never rendered as an empty list (R5-M1).
+                refusal.subagentLeg = probe.subagentLeg;
+            }
+            return { refusal };
+        }
+        if (callerClass === 'reactive-swap') {
+            // §4.2: bounded grace — re-check every recheckMs, execute at the FIRST
+            // not-busy observation, never sitting out the full grace; at the
+            // deadline the swap proceeds WITH mitigations (any new turn on a walled
+            // account is failing anyway). Never refused: deferring long has no
+            // upside; the grace only absorbs a mid-write tool call.
+            const wait = ctx.wait ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+            const deadline = this.clock() + Math.max(0, knobs.reactiveGraceMs);
+            const recheck = Math.max(250, knobs.recheckMs);
+            while (this.clock() < deadline) {
+                await wait(Math.min(recheck, Math.max(1, deadline - this.clock())));
+                try {
+                    const p = await ctx.probe(opts.sessionName);
+                    probe = p;
+                    if (!p.busy)
+                        return {}; // work landed — a clean swap, no mitigations
+                }
+                catch {
+                    /* stays busy-for-grace (I7) — the deadline still bounds the wait */
+                }
+            }
+            return { mitigationBlock: this.buildMitigation(opts, stateSession, topicId, probe, false) };
+        }
+        // interactive-refresh + force: proceed with the mitigation toll (§4.5).
+        return { mitigationBlock: this.buildMitigation(opts, stateSession, topicId, probe, true) };
+    }
+    /**
+     * §4.5 pre-202 interactive busy precheck — lets `/sessions/refresh` answer
+     * the truth SYNCHRONOUSLY (HTTP 409 `session-busy`) instead of
+     * accepting-then-failing. Returns null when the gate is absent/dark/dry-run
+     * or the session is idle (the route then 202s and schedules the refresh; the
+     * in-funnel gate remains the authority for the raced window). A busy verdict
+     * records the §6.1 interactive refusal row.
+     */
+    async precheckInteractiveBusy(sessionName) {
+        const ctx = this.deps.workGateCtx;
+        if (!ctx)
+            return null;
+        let knobs;
+        try {
+            knobs = ctx.getKnobs();
+        }
+        catch {
+            // @silent-fallback-ok: a broken knob getter reads as gate-dark — the
+            // work gate is ADDITIVE and must never block a refresh (§4.5).
+            return null;
+        }
+        if (!knobs.enabled || knobs.dryRun)
+            return null;
+        let probe;
+        try {
+            probe = await ctx.probe(sessionName);
+        }
+        catch {
+            // @silent-fallback-ok: probe machinery failed — I7: uncertainty resolves
+            // BUSY, the safe direction (the caller gets the 409/refusal, never a
+            // wrong kill); the refusal itself is the loud surface.
+            probe = {
+                busy: true,
+                turnLeg: 'indeterminate',
+                subagentLeg: 'indeterminate',
+                turnInFlight: false,
+                subagents: null,
+                reason: 'busy-indeterminate',
+            };
+        }
+        if (!probe.busy)
+            return null;
+        try {
+            ctx.recordInteractiveRefusal?.({
+                session: sessionName,
+                nowMs: this.clock(),
+                inFlight: { turn: probe.turnInFlight, subagents: probe.subagents?.length ?? 0 },
+                subagentLeg: probe.subagentLeg,
+            });
+        }
+        catch {
+            /* ledger hooks are additive — never block the refusal itself */
+        }
+        const busyReason = probe.reason ?? 'busy-indeterminate';
+        const out = {
+            turnInFlight: probe.turnInFlight,
+            message: `Session "${sessionName}" has in-flight work (${busyReason}). Wait for it to land, or re-issue with force:true (the kill then carries the mitigation payload).`,
+        };
+        if (probe.subagentLeg === 'ok') {
+            // Counts and ages only — never titles/paths/content (§4.5).
+            out.subagents = (probe.subagents ?? []).map((s) => ({ agentType: s.agentType, ageMinutes: s.ageMinutes }));
+        }
+        else {
+            // Unreadable is never rendered as an empty list (R5-M1).
+            out.subagentLeg = probe.subagentLeg;
+        }
+        return out;
+    }
+    /** Build + record the §4.3 mitigation payload. Additive to the respawn and
+     *  never gates it — a failure here logs and proceeds (the kill is already
+     *  justified when we reach here; the mitigation must not become a new wedge). */
+    buildMitigation(opts, stateSession, topicId, probe, forced) {
+        try {
+            const ctx = this.deps.workGateCtx;
+            // Unreadable ≠ zero (R5-M1): a null enumeration renders the honesty
+            // line, never an implicit empty list.
+            const killed = probe.subagentLeg === 'ok' ? (probe.subagents ?? []) : null;
+            let inbound = 'unknown';
+            if (topicId !== null && ctx.resolveUnansweredInbound) {
+                try {
+                    inbound = ctx.resolveUnansweredInbound(topicId);
+                }
+                catch {
+                    inbound = 'unknown';
+                }
+            }
+            const busyReason = probe.reason ?? 'busy-indeterminate';
+            const inboundState = inbound === 'none' ? 'none' : inbound === 'unknown' ? 'unknown' : 'reinjected';
+            try {
+                ctx.recordProceeded?.({
+                    session: opts.sessionName,
+                    kind: forced ? 'interactive' : 'reactive',
+                    callerClass: forced ? 'interactive-refresh' : 'reactive-swap',
+                    nowMs: this.clock(),
+                    from: stateSession.subscriptionAccountId ?? '',
+                    ...(opts.accountId ? { to: opts.accountId } : {}),
+                    reason: busyReason,
+                    inFlight: { turn: probe.turnInFlight, subagents: probe.subagents?.length ?? 0 },
+                    subagentLeg: probe.subagentLeg,
+                    ...(killed !== null ? { killedSubagents: killed.length, killedSubagentList: killed } : {}),
+                    inbound: inboundState,
+                    ...(forced ? { force: true } : {}),
+                });
+            }
+            catch {
+                /* @silent-fallback-ok: ledger hooks never gate the respawn — the
+                   PROCEEDED console line below is the loud surface for this path */
+            }
+            console.log(`[SwapWorkGate] PROCEEDED-WITH-MITIGATIONS session=${opts.sessionName} caller=${forced ? 'interactive-refresh' : 'reactive-swap'} ` +
+                `killedSubagents=${killed !== null ? killed.length : 'unreadable'} inbound=${inboundState}`);
+            return buildMitigationPayload({ killedSubagents: killed, inbound });
+        }
+        catch {
+            // @silent-fallback-ok: mitigations are best-effort and never gate the
+            // respawn — the console.warn here IS the report; the respawn proceeds.
+            console.warn(`[SwapWorkGate] mitigation payload failed for session=${opts.sessionName} — proceeding without it (mitigations never gate the respawn)`);
+            return '';
+        }
+    }
     /**
      * Returns true if a fresh refresh is allowed under the rolling window cap.
      * Pure read of the recent-refresh ledger; does not mutate.