mixdog 1.2.3 → 1.2.5

package/src/runtime/agent/orchestrator/session/manager/session-owner-liveness.mjs

@@ -1,117 +0,0 @@
-// manager/session-owner-liveness.mjs
-// Is another live process driving this session right now?
-//
-// Attach-on-resume guard: resuming a session that another live process is
-// ACTIVELY driving right now must not create a second writer on the same
-// file — that split-brain silently freezes one side's transcript (generation
-// ownership drops the loser's saves). Such a resume ATTACHES instead: the
-// caller gets the live transcript flagged remoteAttached, its submits are
-// persisted into the shared pending spool (the owner's injection poller runs
-// them as normal user turns), and its view refreshes from disk. ONE writer,
-// ONE transcript, every surface talking into the same conversation. Idle
-// sessions keep the normal single-identity handoff.
-//
-// The answer comes from three durable signals — the in-process runtime entry,
-// the `.own` presence sidecar and the `.hb` heartbeat — each verified against
-// the pid the sidecar recorded so a force-killed owner can never look live.
-// The session file's own `lastHeartbeatAt`/`clientHostPid` are NOT liveness
-// evidence: the file outlives its writer, and its host pid can name an older
-// process (or a recycled pid), so a restart within the freshness window
-// reopened the session as a viewer whose prompts spooled to nobody.
-import {
-  loadSession,
-  saveSession,
-  readSessionHeartbeatMtime,
-  readSessionPresenceMtime,
-  isSessionPresenceOwnerDead,
-  deleteSessionPresence,
-  isSessionHeartbeatOwnerDead,
-  readSessionHeartbeatOwnerPid,
-  deleteHeartbeat,
-} from '../store.mjs';
-import { _getRuntimeEntry } from './runtime-liveness.mjs';
-import { clearTurnCheckpoint, recoverTurnCheckpoint } from './turn-checkpoint.mjs';
-
-const ACTIVE_OWNER_HB_FRESH_MS = 2 * 60 * 1000; // heartbeat freshness window
-
-export function _isActivelyOwnedElsewhere(_session, sessionId) {
-  // This process already owns the runtime for the id — switching back to
-  // one of our own sessions (desktop tab switch, TUI /resume) never attaches.
-  const entry = _getRuntimeEntry(sessionId);
-  if (entry && entry.closed !== true) return false;
-  // A FORCE-KILLED owner leaves its `.own` sidecar behind looking fresh.
-  // The recorded pid is authoritative: when it no longer exists, the owner
-  // is gone — clear the stale sidecar and resume with normal ownership
-  // instead of viewer-attaching into a spool nobody drains.
-  if (isSessionPresenceOwnerDead(sessionId)) {
-    deleteSessionPresence(sessionId);
-    return false;
-  }
-  const now = Date.now();
-  // Presence (`.own`, pid-verified just above) covers the idle gaps between
-  // turns: a live interactive surface keeps refreshing it (~20s) for its
-  // CURRENT session, so cross-opening an idle-but-open session still
-  // attaches as a viewer instead of splitting ownership into two writers
-  // that clobber each other's saves.
-  const presenceAt = Number(readSessionPresenceMtime(sessionId)) || 0;
-  if (presenceAt > 0 && now - presenceAt <= ACTIVE_OWNER_HB_FRESH_MS) return true;
-  // Heartbeats publish only while a turn is running (≤5s cadence) and the
-  // sidecar is deleted on detach/close, so freshness here means another
-  // process is mid-conversation on this session right now — PROVIDED that
-  // process still exists. Without the pid check a force-killed owner (app
-  // upgrade restart, crash) kept looking live for the whole freshness
-  // window, so every cross-open attached as a viewer and the user's
-  // messages spooled to a queue nobody drains (silently dropped 30m later).
-  if (isSessionHeartbeatOwnerDead(sessionId)) {
-    void deleteHeartbeat(sessionId);
-    return false;
-  }
-  // Fresh sidecar whose recorded pid is alive: a real owner is driving this
-  // session right now. Anything weaker (no sidecar, a pid-less legacy one)
-  // proves no live owner, whatever the session file remembers.
-  const sidecarAt = Number(readSessionHeartbeatMtime(sessionId)) || 0;
-  return sidecarAt > 0 && now - sidecarAt <= ACTIVE_OWNER_HB_FRESH_MS && readSessionHeartbeatOwnerPid(sessionId) > 0;
-}
-
-// Viewer self-heal probe: true when a re-resume of this session would NO
-// LONGER attach (owner dead or every liveness signal stale). Attached
-// surfaces poll this so a dead owner promotes the viewer instead of leaving
-// it spooling messages to nobody. Single source of truth: the same guard
-// the resume path uses.
-export function isSessionOwnerGone(sessionId) {
-  const session = loadSession(sessionId);
-  if (!session) return false;
-  return !_isActivelyOwnedElsewhere(session, sessionId);
-}
-
-export function _recoverTurnCheckpointDurably(session, sessionId) {
-  const recovery = recoverTurnCheckpoint(session);
-  if (!recovery.changed) return recovery;
-  // Recovery is a durable reconnect boundary, not a renderer-only view.
-  // Persist before removing the checkpoint so a second crash leaves at
-  // least one complete copy of the interrupted turn.
-  saveSession(session, {
-    sync: true,
-    expectedGeneration: session.generation,
-  });
-  if (recovery.turnToken) {
-    clearTurnCheckpoint(sessionId, recovery.turnToken);
-  }
-  // A force-killed owner cannot clear its activity/presence sidecars. Once
-  // its checkpoint is committed as interrupted, neither sidecar may keep a
-  // restored pane busy or make a new prompt queue behind a dead process.
-  deleteSessionPresence(sessionId);
-  void deleteHeartbeat(sessionId);
-  return recovery;
-}
-
-// Reconnect-safe historical read used by desktop pane peeks. Unlike a normal
-// read-only load, it resolves a dead owner's durable turn checkpoint before
-// returning the transcript. A genuinely live foreign owner remains untouched.
-export function recoverSessionAfterProcessRestart(sessionId) {
-  const session = loadSession(sessionId);
-  if (!session || session.closed === true) return session || null;
-  if (_isActivelyOwnedElsewhere(session, sessionId)) return session;
-  _recoverTurnCheckpointDurably(session, sessionId);
-  return session;
-}

package/src/runtime/agent/orchestrator/session/store/paths-heartbeat.mjs

@@ -1,302 +0,0 @@
-import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, unlinkSync } from 'node:fs';
-import * as fsp from 'node:fs/promises';
-import { join } from 'node:path';
-import { getPluginData } from '../../config.mjs';
-
-// Session file paths are rebuilt on every load/save/sidecar probe. Memoize the
-// joined strings per data dir: a changed data dir (MIXDOG_DATA_DIR switch)
-// drops the whole memo, and the per-extension maps are bounded.
-const SESSION_PATH_MEMO_LIMIT = 4096;
-let _memoDataDir = null;
-let _memoStoreDir = null;
-const _memoFilePaths = new Map(); // extension → Map<id, path>
-
-function _storeDirPath() {
-  const dataDir = getPluginData();
-  if (dataDir !== _memoDataDir) {
-    _memoDataDir = dataDir;
-    _memoStoreDir = join(dataDir, 'sessions');
-    _memoFilePaths.clear();
-  }
-  return _memoStoreDir;
-}
-
-function _memoFilePath(dir, id, extension) {
-  let byId = _memoFilePaths.get(extension);
-  if (!byId) {
-    byId = new Map();
-    _memoFilePaths.set(extension, byId);
-  }
-  let path = byId.get(id);
-  if (path === undefined) {
-    path = join(dir, _sessionFileName(id, extension));
-    if (byId.size >= SESSION_PATH_MEMO_LIMIT) byId.clear();
-    byId.set(id, path);
-  }
-  return path;
-}
-export function getStoreDir() {
-  const dir = _storeDirPath();
-  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-  return dir;
-}
-function _sessionFileName(id, extension) {
-  return `${id}${extension}`;
-}
-// Enforce minted session-id shape before using it in a path to prevent
-// `../` traversal. session IDs are generated by createSession as
-// `sess_<timestamp>_<hex>` — reject anything that doesn't match.
-function _assertSessionId(id) {
-  if (!id || typeof id !== 'string' || !/^[A-Za-z0-9_-]+$/.test(id)) {
-    throw new Error(`[session-store] invalid session id: ${JSON.stringify(id)}`);
-  }
-}
-function _sessionFilePath(id, extension) {
-  _assertSessionId(id);
-  return _memoFilePath(getStoreDir(), id, extension);
-}
-export function sessionPath(id) {
-  return _sessionFilePath(id, '.json');
-}
-
-// ── Sidecar owner-pid helpers ─────────────────────────────
-// Liveness sidecars record the publishing process id on their SECOND line so
-// a reader can tell a genuinely live owner from a force-killed one whose
-// timestamp still looks fresh. Legacy (pid-less) sidecars read back as 0.
-export function isProcessAlive(pid) {
-  const target = Number(pid) || 0;
-  if (target <= 0) return false;
-  try {
-    process.kill(target, 0);
-    return true;
-  } catch (error) {
-    // ESRCH: no such process. EPERM means the pid exists (alive).
-    return error?.code !== 'ESRCH';
-  }
-}
-
-function _readSidecarOwnerPid(path) {
-  try {
-    return Number(String(readFileSync(path, 'utf8')).split('\n')[1]) || 0;
-  } catch {
-    return 0;
-  }
-}
-
-/** True only when the sidecar recorded an owner pid that no longer exists
- *  (pid-less legacy sidecars prove nothing and read false). */
-export function isSidecarOwnerDead(path) {
-  const pid = _readSidecarOwnerPid(path);
-  return pid > 0 && !isProcessAlive(pid);
-}
-
-// ── Heartbeat publish ─────────────────────────────────────
-// Lightweight per-session timestamp file (`<id>.hb`) consumed by the
-// status aggregator for fresh-session detection. Decoupled from the
-// full session JSON save so it can fire at a tight cadence (≤5s)
-// without serialising the whole payload. The .hb file holds
-// `<msTimestamp>\n<pid>\n` — readers that only need liveness use the file
-// mtime, while the attach-on-resume guard verifies the recorded pid.
-// Aggregator scans the same sessions/ directory and matches `<id>.hb` to
-// `<id>.json`.
-const _HEARTBEAT_THROTTLE_MS = 5_000;
-const _hbLastAt = new Map();
-const _hbOperations = new Map();
-
-function _queueHeartbeatOperation(id, operation) {
-  const prior = _hbOperations.get(id) || Promise.resolve();
-  const next = prior.then(operation, operation).catch(() => {});
-  _hbOperations.set(id, next);
-  void next.then(() => {
-    if (_hbOperations.get(id) === next) _hbOperations.delete(id);
-  });
-  return next;
-}
-
-function _heartbeatPath(id) {
-  return _sessionFilePath(id, '.hb');
-}
-
-export function publishHeartbeat(id, ts) {
-  if (!id) return Promise.resolve();
-  const now = ts || Date.now();
-  const last = _hbLastAt.get(id) || 0;
-  if (now - last < _HEARTBEAT_THROTTLE_MS) {
-    return _hbOperations.get(id) || Promise.resolve();
-  }
-  const target = _heartbeatPath(id);
-  _hbLastAt.set(id, now);
-  return _queueHeartbeatOperation(id, () => fsp.writeFile(target, `${now}\n${process.pid}\n`, 'utf8'));
-}
-
-export function deleteHeartbeat(id) {
-  if (!id) return Promise.resolve();
-  // Deleting needs no directory: skip getStoreDir's synchronous probe.
-  _assertSessionId(id);
-  const target = _memoFilePath(_storeDirPath(), id, '.hb');
-  // One ordered async delete behind any pending write for this id. It starts
-  // on the next microtask when nothing is pending, so the marker still drops
-  // at once, without a synchronous unlink on the turn-settle path. Queuing it
-  // (rather than deleting beside the write) keeps a write started just before
-  // turn completion from landing after the delete and resurrecting the
-  // session's working badge for the full freshness window.
-  _hbLastAt.delete(id);
-  return _queueHeartbeatOperation(id, () => fsp.unlink(target).catch(() => {}));
-}
-
-// Batch reader for session catalogs. Scanning only the handful of `.hb`
-// sidecars avoids one failed stat per historical session while still exposing
-// cross-process turn activity to desktop/TUI resume lists.
-export function listSessionHeartbeatMtimes() {
-  const result = new Map();
-  try {
-    const dir = getStoreDir();
-    for (const filename of readdirSync(dir)) {
-      if (!filename.endsWith('.hb')) continue;
-      const id = filename.slice(0, -3);
-      if (!/^[A-Za-z0-9_-]+$/.test(id)) continue;
-      try {
-        const mtime = statSync(join(dir, filename)).mtimeMs || 0;
-        if (mtime > 0) result.set(id, mtime);
-      } catch {
-        /* sidecar disappeared after readdir */
-      }
-    }
-  } catch {
-    /* catalog activity is best-effort */
-  }
-  return result;
-}
-
-// Owner pid recorded in the `<id>.hb` sidecar (0 when absent or written by a
-// pre-pid build).
-export function readSessionHeartbeatOwnerPid(id) {
-  if (!id) return 0;
-  try {
-    return _readSidecarOwnerPid(_heartbeatPath(id));
-  } catch {
-    return 0;
-  }
-}
-
-// A killed owner never deletes its `.hb` sidecar, so bare mtime freshness
-// would keep the session "actively driven" for the whole freshness window and
-// every cross-open would attach as a viewer whose submits spool to nobody.
-// The recorded pid is authoritative proof; pid-less legacy sidecars return
-// false (unknown, not dead).
-export function isSessionHeartbeatOwnerDead(id) {
-  const pid = readSessionHeartbeatOwnerPid(id);
-  if (!pid) return false;
-  return !isProcessAlive(pid);
-}
-
-// ── Interactive presence publish ──────────────────────────
-// `<id>.own` marks a live interactive surface (TUI/desktop engine) HOLDING
-// the session open — including idle time between turns. Kept separate from
-// `.hb` (turn-activity signal consumed by the status aggregator and deleted
-// at turn end) so idle presence never fakes a "running" badge. Consumed by
-// the attach-on-resume guard (_isActivelyOwnedElsewhere): fresh presence
-// means a cross-open must attach as a viewer instead of claiming a second
-// writer on the same session file (dual-writer last-save-wins clobbering).
-// Refreshed by the engine share tick (~3s call, throttled here) and cleared
-// on session switch/dispose; staleness covers crashes.
-//
-// Presence is a sidecar OF a session record and never outlives it: it is
-// only published while the record exists, and a publish that loses a race
-// with a deletion (this process or another one unlinked the record and its
-// sidecar while the write was in flight) removes what it just wrote.
-const _PRESENCE_THROTTLE_MS = 20_000;
-const _presenceLastAt = new Map();
-// id -> in-flight publish; deleteSessionPresence cancels it so the write that
-// lands after the unlink is removed again instead of resurrecting the file.
-const _presenceInFlight = new Map();
-
-function _presencePath(id) {
-  return _sessionFilePath(id, '.own');
-}
-
-async function _sessionRecordExists(id) {
-  try {
-    await fsp.stat(sessionPath(id));
-    return true;
-  } catch (error) {
-    // Only a proven absence stops the beacon; an unreadable stat keeps it.
-    return error?.code !== 'ENOENT';
-  }
-}
-
-async function _publishPresence(id, now, flight) {
-  try {
-    // A record that does not exist (never saved yet, or deleted) gets no
-    // beacon; the throttle stays open so the next tick retries.
-    if (!(await _sessionRecordExists(id)) || flight.cancelled) {
-      if (_presenceLastAt.get(id) === now) _presenceLastAt.delete(id);
-      return;
-    }
-    const target = _presencePath(id);
-    await fsp.writeFile(target, `${now}\n${process.pid}\n`, 'utf8');
-    if (flight.cancelled || !(await _sessionRecordExists(id))) {
-      await fsp.unlink(target).catch(() => {});
-      if (_presenceLastAt.get(id) === now) _presenceLastAt.delete(id);
-    }
-  } catch {
-    /* best-effort beacon */
-  } finally {
-    if (_presenceInFlight.get(id) === flight) _presenceInFlight.delete(id);
-  }
-}
-
-export function publishSessionPresence(id, ts) {
-  if (!id) return;
-  const now = ts || Date.now();
-  const last = _presenceLastAt.get(id) || 0;
-  if (now - last < _PRESENCE_THROTTLE_MS) return;
-  if (_presenceInFlight.has(id)) return;
-  _assertSessionId(id);
-  _presenceLastAt.set(id, now);
-  const flight = { cancelled: false, done: null };
-  _presenceInFlight.set(id, flight);
-  flight.done = _publishPresence(id, now, flight);
-}
-
-/** Test/drain seam: resolves once the id's in-flight presence publish settled. */
-export function settleSessionPresence(id) {
-  return _presenceInFlight.get(id)?.done || Promise.resolve();
-}
-
-export function deleteSessionPresence(id) {
-  if (!id) return;
-  const flight = _presenceInFlight.get(id);
-  if (flight) flight.cancelled = true;
-  try {
-    unlinkSync(_presencePath(id));
-  } catch {
-    /* ignore */
-  }
-  _presenceLastAt.delete(id);
-}
-
-export function readSessionPresenceMtime(id) {
-  if (!id) return 0;
-  try {
-    return statSync(_presencePath(id)).mtimeMs || 0;
-  } catch {
-    return 0;
-  }
-}
-
-// A force-killed owner never clears its presence sidecar, so bare mtime
-// freshness would lock every resume inside the window into viewer mode with
-// nobody draining the shared spool. The `.own` payload records the holder's
-// pid; a recorded-but-dead pid is authoritative proof the owner is gone.
-export function isSessionPresenceOwnerDead(id) {
-  if (!id) return false;
-  let pid = 0;
-  try {
-    pid = _readSidecarOwnerPid(_presencePath(id));
-  } catch {
-    return false;
-  }
-  if (!pid) return false;
-  return !isProcessAlive(pid);
-}

package/src/session-runtime/services/agent-tool/terminal-reaper/reap-timers.mjs

@@ -1,142 +0,0 @@
-// Delayed reap timers: arm a terminal row's deadline, fire the reap when it
-// elapses, and rebuild the timers after a process restart.
-import { clean, clearAgentStatuslineRoute } from '../helpers.mjs';
-import { workerRowTime } from '../worker-rows.mjs';
-import { resolveAgentTerminalReapMs } from '../../../../runtime/agent/orchestrator/runtime-core/config-helpers.mjs';
-import { isTerminalRow } from './row-helpers.mjs';
-
-export function createReapTimers({ cfgMod, mgr, index, getLiveSession, tagForSession, tombstoneTerminalSession }) {
-  const { readWorkerRows, writeWorkerRows, flushWorkerIndexMutations } = index;
-  const reapTimers = new Map();
-  // sessionId -> the reapAt a live timer was armed for. Lets a repeated session
-  // scan recognise an already-armed deadline instead of re-arming (and thus
-  // re-stamping) the same terminal lease on every list read.
-  const scheduledReapAt = new Map();
-
-  function isArmedFor(sessionId, reapAt) {
-    return reapTimers.has(sessionId) && scheduledReapAt.get(sessionId) === reapAt;
-  }
-
-  /** closeAll() drops every timer wholesale; the armed-deadline bookkeeping
-   * must go with them or a later scan would trust a timer that no longer runs. */
-  function clearScheduledReaps() {
-    scheduledReapAt.clear();
-  }
-
-  function cancelReap(sessionId) {
-    const handle = reapTimers.get(sessionId);
-    scheduledReapAt.delete(sessionId);
-    if (!handle) return false;
-    clearTimeout(handle);
-    reapTimers.delete(sessionId);
-    return true;
-  }
-
-  function reapTerminalRow(row) {
-    const sessionId = clean(row?.sessionId);
-    const reapAt = clean(row?.reapAt);
-    const tag = clean(row?.tag) || tagForSession(sessionId);
-    if (!sessionId || !reapAt || !tag) return false;
-    const session = getLiveSession(sessionId);
-    if (!tombstoneTerminalSession(tag, sessionId, session, reapAt)) return false;
-    try {
-      mgr.hideSessionFromList?.(sessionId);
-    } catch {}
-    clearAgentStatuslineRoute(sessionId);
-    // Reaping expires only the reusable tag/runtime lease. The transcript is
-    // user-visible from the parent task's agent tab, so terminal cleanup must
-    // never tombstone it ahead of that parent.
-    try {
-      mgr.unloadSessionRuntime?.(sessionId, 'terminal-reap');
-    } catch {}
-    return true;
-  }
-
-  function schedulePersistedReap(row) {
-    const sessionId = clean(row?.sessionId);
-    const reapAt = clean(row?.reapAt);
-    const deadline = Date.parse(reapAt) || 0;
-    if (!sessionId || !deadline) return false;
-    cancelReap(sessionId);
-    const handle = setTimeout(
-      () => {
-        reapTimers.delete(sessionId);
-        scheduledReapAt.delete(sessionId);
-        reapTerminalRow(row);
-      },
-      Math.max(0, deadline - Date.now())
-    );
-    handle.unref?.();
-    reapTimers.set(sessionId, handle);
-    scheduledReapAt.set(sessionId, reapAt);
-    return true;
-  }
-
-  function scheduleReap(sessionId, provider = null) {
-    const id = clean(sessionId);
-    if (!id) return false;
-    cancelReap(id);
-    // The terminal upsert is deferred to batch parallel fanout writes. Flush it
-    // before stamping the deadline so reapAt and the terminal state land in one
-    // durable lifecycle order.
-    flushWorkerIndexMutations();
-    const row = readWorkerRows().find((entry) => clean(entry.sessionId) === id);
-    if (!row || !isTerminalRow(row)) return false;
-    const reapProvider = clean(provider) || clean(row.provider) || clean(getLiveSession(id)?.provider) || null;
-    const reapMs = resolveAgentTerminalReapMs(cfgMod.loadConfig(), reapProvider);
-    const reapAt = reapMs == null ? null : new Date(Date.now() + reapMs).toISOString();
-    let persisted = null;
-    writeWorkerRows((byKey) => {
-      for (const [key, current] of byKey.entries()) {
-        if (clean(current.sessionId) !== id) continue;
-        if (!isTerminalRow(current)) return;
-        persisted = { ...current, reapAt };
-        byKey.set(key, persisted);
-        return;
-      }
-    });
-    return persisted?.reapAt ? schedulePersistedReap(persisted) : false;
-  }
-
-  /** Rebuild child terminal timers after a process restart. Legacy rows have
-   * no reapAt, so derive the original absolute deadline from their frozen
-   * terminal stamp instead of granting a fresh full lease on every boot. */
-  function recoverTerminalReaps() {
-    flushWorkerIndexMutations();
-    const now = Date.now();
-    const recovered = [];
-    writeWorkerRows((byKey) => {
-      for (const [key, row] of byKey.entries()) {
-        if (!isTerminalRow(row)) continue;
-        let reapAt = clean(row.reapAt);
-        if (!(Date.parse(reapAt) > 0)) {
-          const reapMs = resolveAgentTerminalReapMs(cfgMod.loadConfig(), row.provider);
-          if (reapMs == null) continue;
-          const terminalAt = workerRowTime(row);
-          // A timestamp-free legacy row cannot prove that its grace already
-          // elapsed. Give it one normal window from recovery; timestamped rows
-          // keep their original completion-based deadline.
-          reapAt = new Date((terminalAt > 0 ? terminalAt : now) + reapMs).toISOString();
-        }
-        const next = { ...row, reapAt };
-        byKey.set(key, next);
-        recovered.push(next);
-      }
-    });
-    for (const row of recovered) {
-      if ((Date.parse(row.reapAt) || 0) <= now) reapTerminalRow(row);
-      else schedulePersistedReap(row);
-    }
-  }
-
-  return {
-    reapTimers,
-    isArmedFor,
-    clearScheduledReaps,
-    cancelReap,
-    reapTerminalRow,
-    schedulePersistedReap,
-    scheduleReap,
-    recoverTerminalReaps,
-  };
-}

package/src/session-runtime/turn/share-ops.mjs

@@ -1,77 +0,0 @@
-/**
- * src/session-runtime/turn/share-ops.mjs - cross-surface session sharing on
- * the owner side: pending-spool intake, presence beacon, and the viewer's
- * owner-liveness probe.
- */
-export function createShareOps({ getSession, getActiveTurnCount, mgr, isSessionAdmissionOpen }) {
-  // Owner-side injection intake: foreign user messages persisted into the
-  // shared spool by an attached surface. Engine pollers call this while
-  // idle and run each returned text through the normal submit queue.
-  async function takeRemoteInjections() {
-    const session = getSession();
-    if (!session?.id || session.remoteAttached) return [];
-    // Pending-spool intake is an admission route: a fenced/closed owner leaves
-    // the spool untouched.
-    if (isSessionAdmissionOpen && !isSessionAdmissionOpen()) return [];
-    if (getActiveTurnCount() > 0) return [];
-    try {
-      return (await mgr.drainForeignUserInjections?.(session.id)) || [];
-    } catch {
-      return [];
-    }
-  }
-
-  // Absolute path of THIS session's pending spool shard. Live-share owners
-  // fs.watch it for instant cross-surface input pickup; empty string when
-  // there is no session or the store is unavailable (callers fall back to the
-  // poll tick).
-  function pendingSpoolPath() {
-    try {
-      return mgr.pendingMessagesSpoolPath?.(getSession()?.id) || '';
-    } catch {
-      return '';
-    }
-  }
-
-  // Interactive-presence beacon (engine share tick): mark the CURRENT
-  // session as held open by this live surface — idle time included — so a
-  // cross-open from another surface attaches as a viewer instead of
-  // splitting ownership into two writers. No-op while THIS surface is the
-  // viewer. Returns the held id so the caller can clear a previous
-  // session's beacon after a switch.
-  function publishSessionPresence() {
-    const session = getSession();
-    if (!session?.id || session.remoteAttached) return null;
-    try {
-      mgr.publishSessionPresence?.(session.id);
-    } catch {
-      /* best-effort */
-    }
-    return session.id;
-  }
-
-  function clearSessionPresence(id) {
-    const target = id || getSession()?.id;
-    if (!target) return;
-    try {
-      mgr.deleteSessionPresence?.(target);
-    } catch {
-      /* best-effort */
-    }
-  }
-
-  // Live-owner liveness probe for the viewer self-heal tick: true when a
-  // re-resume would no longer attach (owner pid dead or every liveness
-  // signal stale) — i.e. nobody is draining this session's spool anymore.
-  function sessionOwnerGone(id) {
-    const target = id || getSession()?.id;
-    if (!target) return false;
-    try {
-      return mgr.isSessionOwnerGone?.(target) === true;
-    } catch {
-      return false;
-    }
-  }
-
-  return { takeRemoteInjections, pendingSpoolPath, publishSessionPresence, clearSessionPresence, sessionOwnerGone };
-}