mixdog 1.4.1 → 1.4.3

package/src/standalone/session-service/quota-resume.mjs

@@ -124,6 +124,15 @@ export function createQuotaResumeScheduler({
   function tick() {
     if (running) return running;
     running = (async () => {
+      // The setting turned off anywhere (another process, a hand edit), not
+      // only through setQuotaAutoResumeEnabled here: nothing pending resumes.
+      if (store.quotaAutoResumeEnabled?.() === false) {
+        if (store.listQuotaResumeEntries().length) {
+          store.cancelAllQuotaResumeEntries();
+          log('quota resume off: pending resumes cancelled');
+        }
+        return;
+      }
       for (const entry of store.listQuotaResumeEntries()) {
         if (isClosed()) return;
         if (entry.resetAt > now() || !isCurrent(store, entry)) continue;

package/src/standalone/session-service/session-calls/session-action.mjs

@@ -5,6 +5,7 @@ import { SESSION_CONFIGURE_ACTION_SET, SESSION_READ_ACTION_SET } from '../../ses
 import { annotateSpan, markPhase } from '../../../runtime/shared/slow-span.mjs';
 import { sanitizeForWire } from '../../session-wire-values.mjs';
 import { botWorkBySession } from '../../../runtime/shared/bot-owned-work.mjs';
+import { createSessionTurnGate } from './turn-gate.mjs';
 
 /** Reads a session without a live runtime answers from disk (readStoredReview). */
 const STORED_REVIEW_ACTIONS = new Set([
@@ -43,6 +44,9 @@ export function createSessionActionCalls(ctx) {
   const { bodyForClient } = ctx.projection;
   const { retainUnwatched, awaitingApprovalSessionKinds, roomHandoffQuestions } = ctx.retention;
   const { assertAvailable, hostedEntryForSession, entryForSession } = ctx.entries;
+  const { stateBusy } = ctx.retention;
+  const sessionOwner = ctx.projection?.sessionOwner;
+  const turnGate = ctx.turnGate ?? createSessionTurnGate();
 
   /** A cold session's review, read from its durable turn record (the same
    *  source a runtime loaded only to answer it would read). Bodiless: the
@@ -82,7 +86,12 @@ export function createSessionActionCalls(ctx) {
     if (storedReview && !hosted) return storedReviewResult(id, name, args, baseRevision);
     const entry = hosted || (await entryForSession(id, openHints || {}));
     assertAvailable(entry);
-    const target = entry.runtime[name];
+    // A remote read of the context status waits for an empty session's
+    // settings reconcile; the local accessor stays synchronous.
+    const target =
+      name === 'contextStatus' && typeof entry.runtime.contextStatusSettled === 'function'
+        ? entry.runtime.contextStatusSettled
+        : entry.runtime[name];
     if (typeof target !== 'function') throw new TypeError(`session action ${name} is unavailable`);
     markPhase('load');
     const value = await target.apply(entry.runtime, Array.isArray(args) ? args : []);
@@ -162,9 +171,50 @@ export function createSessionActionCalls(ctx) {
     };
   }
 
+  /** The desktop's auto-delete through the control session (`sessionId`):
+   *  `args` = [target id, { lastUsedAt }]. The target is closed to service
+   *  turn starts while the runtime's idle-only delete checks and acts
+   *  (session-delete.mjs deleteSessionIfIdle); one being admitted refuses it. */
+  async function deleteIdleSession({ sessionId, args = [], open: openHints = {}, baseRevision = null } = {}) {
+    assertAvailable();
+    const controlId = String(sessionId || '');
+    if (!controlId) throw new TypeError('sessionId is required');
+    const [target, expected] = Array.isArray(args) ? args : [];
+    const id = String(target || '');
+    const entry = await entryForSession(controlId, openHints || {});
+    assertAvailable(entry);
+    if (typeof entry.runtime.deleteSessionIfIdle !== 'function') {
+      throw new TypeError('session action deleteSessionIfIdle is unavailable');
+    }
+    let value;
+    const reopen = id ? turnGate.fence(id) : null;
+    if (!reopen) value = { deleted: false, reason: id ? 'turn-starting' : 'invalid' };
+    else {
+      try {
+        value = await entry.runtime.deleteSessionIfIdle(id, expected ?? {}, {
+          isHostedBusy: (sessionIdToCheck) => {
+            const owner = sessionOwner?.(sessionIdToCheck);
+            return Boolean(owner) && stateBusy(owner.runtime?.getState?.());
+          },
+        });
+      } finally {
+        reopen();
+      }
+    }
+    log(`session action deleteSessionIfIdle session=${id} result=${resultSummary(value?.deleted ?? value)}`);
+    const step = advanceForCaller(entry);
+    retainUnwatched(entry);
+    return {
+      value: sanitizeForWire(value) ?? null,
+      sessionId: responseSessionId(entry, controlId),
+      ...bodyForClient(step, Number.isInteger(baseRevision) ? baseRevision : null),
+    };
+  }
+
   async function configureSession(params = {}, callCtx = null) {
     const revision = Math.max(0, Number(callCtx?.revision) || 0);
     const action = params?.action;
+    if (action === 'deleteSessionIfIdle') return deleteIdleSession(params);
     // Revision 0 desktop adapters routed some reads through configure because
     // their local read list lagged the session surface. A newer daemon accepts
     // those reads without weakening the current revision's finite lanes.

package/src/standalone/session-service/session-calls/session-turns.mjs

@@ -4,6 +4,7 @@
 // sessions that carry an active Goal after daemon replacement is wired in from
 // ./goal-recovery.mjs.
 import { createGoalRecovery } from './goal-recovery.mjs';
+import { createSessionTurnGate } from './turn-gate.mjs';
 import {
   attachmentsForIntake,
   materializePromptSubmission,
@@ -54,6 +55,8 @@ export function createSessionTurnCalls(ctx) {
   const { log, readStoredGoal, listStoredActiveGoalSessionIds, hasAgentSession, sessionResult, advanceForCaller } = ctx;
   const { retainUnwatched } = ctx.retention;
   const { entryForSession } = ctx.entries;
+  // One gate per service, shared with the idle-only delete (session-calls.mjs).
+  const turnGate = ctx.turnGate ?? createSessionTurnGate();
 
   /** Publishes the step an action produced and keeps the entry on the retention clock. */
   const settleAction = (entry, reason) => {
@@ -66,16 +69,26 @@ export function createSessionTurnCalls(ctx) {
   // attachment conversion that has not yet become a turn.
   const intakeAborts = new Map();
 
-  async function submitSession({
-    sessionId,
-    prompt,
-    options = {},
-    open: openHints = {},
-    baseRevision = null,
-    signal = null,
-  } = {}) {
-    const id = String(sessionId || '');
+  /** Run `start` as an admitted turn start of `sessionId` (turn-gate.mjs). */
+  async function admitted(sessionId, start) {
+    const leave = turnGate.enter(sessionId);
+    try {
+      return await start();
+    } finally {
+      leave();
+    }
+  }
+
+  async function submitSession(params = {}) {
+    const id = String(params?.sessionId || '');
     if (!id) throw new TypeError('sessionId is required');
+    return admitted(id, () => submitAdmitted(id, params));
+  }
+
+  async function submitAdmitted(
+    id,
+    { prompt, options = {}, open: openHints = {}, baseRevision = null, signal = null } = {}
+  ) {
     const entry = await entryForSession(id, openHints || {});
     const target = entry.runtime.submitAsync;
     if (typeof target !== 'function') throw new TypeError('session runtime must implement submitAsync');
@@ -150,9 +163,12 @@ export function createSessionTurnCalls(ctx) {
   async function materializeSession(sessionId, openHints = {}) {
     const id = String(sessionId || '');
     if (!id) throw new TypeError('sessionId is required');
-    const entry = await entryForSession(id, openHints || {});
-    retainUnwatched(entry, 'daemon session owner');
-    return entry.runtime;
+    // Its callers start work on the runtime (Goal and quota resumes, bots).
+    return admitted(id, async () => {
+      const entry = await entryForSession(id, openHints || {});
+      retainUnwatched(entry, 'daemon session owner');
+      return entry.runtime;
+    });
   }
 
   const recoverActiveGoals = createGoalRecovery({
@@ -196,12 +212,15 @@ export function createSessionTurnCalls(ctx) {
   async function approveSession({ sessionId, approvalId, decision, open: openHints = {}, baseRevision = null } = {}) {
     const id = String(sessionId || '');
     if (!id) throw new TypeError('sessionId is required');
-    const entry = await entryForSession(id, openHints || {});
-    const target = entry.runtime.resolveToolApproval;
-    if (typeof target !== 'function') {
-      throw new TypeError('session action resolveToolApproval is unavailable');
-    }
-    const approved = await target.call(entry.runtime, approvalId, decision);
+    // An answer resumes the turn: an admitted start.
+    const { entry, approved } = await admitted(id, async () => {
+      const hosted = await entryForSession(id, openHints || {});
+      const target = hosted.runtime.resolveToolApproval;
+      if (typeof target !== 'function') {
+        throw new TypeError('session action resolveToolApproval is unavailable');
+      }
+      return { entry: hosted, approved: await target.call(hosted.runtime, approvalId, decision) };
+    });
     const step = settleAction(entry, 'headless session approval');
     return sessionResult(entry, step, baseRevision, { approved: approved === true });
   }

package/src/standalone/session-service/session-calls/session-views.mjs

@@ -6,60 +6,26 @@ import { SESSION_READ_ACTION_SET } from '../../session-protocol.mjs';
 import { SESSION_ID_PATTERN } from '../agent-tree.mjs';
 import {
   loadLiveTranscriptHead,
+  readTranscriptHistory,
   readTranscriptRange,
   rebudgetTranscriptWindow,
+  requestedTranscriptHistory,
   requestedHeldTranscript,
   requestedTranscriptWindow,
   requestLiveTranscriptWindow,
+  restartTranscriptWindow,
+  transcriptAnswerBounds,
   transcriptPageBody,
+  transcriptWindowOversized,
 } from '../projection/transcript-window.mjs';
 
-export function createSessionViewCalls(ctx) {
-  const { log, readStoredSession, externalViewEntries, runSessionAction, sessionResult, advanceForCaller } = ctx;
-  const { currentSessionId, externalEntryForView, projectionResult, unchangedProjectionResult, sessionOwner } =
-    ctx.projection;
-  /** The owner a concurrent materialization may have produced while a disk
-   *  read was in flight: a daemon-owned runtime outranks an external view. */
-  const lateOwnerFor = (id) => sessionOwner(id) || externalEntryForView(id);
-  const {
-    subscriberToken,
-    addSubscriber,
-    trackPendingViewer,
-    dropPendingViewer,
-    adoptPendingViewers,
-    notePrependViewer,
-  } = ctx.viewers;
-  const { sessionBusy, retainUnwatched, releaseProjection, startEvictionSweep } = ctx.retention;
-  const {
-    assertAvailable,
-    createEntry,
-    getOrCreateSessionEntry,
-    entryForSession,
-    liveEntryForView,
-    bindExternalSessionView,
-    destroy,
-  } = ctx.entries;
-  const {
-    storedSessionProjection,
-    storedProjectionUnchanged,
-    requestedMessageSlice,
-    forgetStoredSession,
-    releaseStoredSession,
-  } = ctx.storedReader;
-
-  /** A read/subscribe names the transcript window its view wants (none: the
-   *  whole transcript). A window grown past what a resumed runtime holds is
-   *  completed from durable history, which a live session never keeps cached. */
-  async function applyTranscriptRequest(entry, params, sessionId) {
-    const request = requestedTranscriptWindow(params);
-    // A model-message read (messageStart) is not a view and leaves the window.
-    if (request || !Number.isInteger(params.messageStart)) requestLiveTranscriptWindow(entry, request);
-    // No baseline the next step can patch: this caller receives the window
-    // whole, so it goes out within its byte budget.
-    if (request && params.baseRevision !== entry.revision) rebudgetTranscriptWindow(entry);
-    if (await loadLiveTranscriptHead(entry, sessionId, readStoredSession)) forgetStoredSession(sessionId);
-    assertAvailable(entry);
-  }
+/** Creating (reserving) a session. */
+function createSessionCreation(ctx) {
+  const { log, sessionResult, advanceForCaller } = ctx;
+  const { currentSessionId } = ctx.projection;
+  const { addSubscriber, adoptPendingViewers } = ctx.viewers;
+  const { retainUnwatched } = ctx.retention;
+  const { assertAvailable, createEntry, getOrCreateSessionEntry, destroy } = ctx.entries;
 
   async function createReservedSession(params, viewer, reservedSessionId) {
     const entry = await createEntry({ ...params, sessionId: reservedSessionId }, viewer);
@@ -103,6 +69,138 @@ export function createSessionViewCalls(ctx) {
     return sessionResult(entry, step);
   }
 
+  return { createSession };
+}
+
+/** The transcript window a live view is answered through: requesting it,
+ *  bounding the answer, and attaching a subscriber to a live entry. */
+function createLiveTranscriptAnswers(ctx) {
+  const { readStoredSession, sessionResult, advanceForCaller } = ctx;
+  const { currentSessionId } = ctx.projection;
+  const { addSubscriber } = ctx.viewers;
+  const { assertAvailable } = ctx.entries;
+
+  /** A read/subscribe names the transcript window its view wants (none: the
+   *  whole transcript). A window grown past what a resumed runtime holds is
+   *  completed from durable history, sliced from the store's cached display
+   *  history of the record's content. */
+  async function applyTranscriptRequest(entry, params, sessionId) {
+    const request = requestedTranscriptWindow(params);
+    // A model-message read (messageStart) is not a view and leaves the window.
+    if (request || !Number.isInteger(params.messageStart)) requestLiveTranscriptWindow(entry, request);
+    // No baseline the next step can patch: this caller receives the window
+    // whole, so it goes out within its byte budget.
+    if (request && params.baseRevision !== entry.revision) rebudgetTranscriptWindow(entry);
+    await loadLiveTranscriptHead(entry, sessionId, readStoredSession);
+    assertAvailable(entry);
+  }
+
+  /** The caller's answer for `step`, reduced to a page when it proves the rows
+   *  it holds and they fit one answer. A window that would go out whole past
+   *  the request's bounds (transcriptAnswerBounds) does not: a caller already
+   *  at this revision needs no body; any other gets a bounded recovery
+   *  snapshot — the window restarts from a fresh tail, which the views
+   *  attached receive as a step too. */
+  function boundedSessionResult(entry, step, params, baseRevision, extra) {
+    const prepend = params.transcriptPrepend === true;
+    const bounds = transcriptAnswerBounds(requestedTranscriptWindow(params));
+    const result = transcriptPageBody(
+      sessionResult(entry, step, baseRevision, extra, { prepend }),
+      requestedHeldTranscript(params),
+      { byteBudget: bounds.byteBudget }
+    );
+    if (!transcriptWindowOversized(entry, result.full, bounds)) return result;
+    if (baseRevision === step.revision) {
+      const { full: _full, ...bodiless } = result;
+      return bodiless;
+    }
+    restartTranscriptWindow(entry, bounds.maxItems);
+    return sessionResult(entry, advanceForCaller(entry), baseRevision, extra, { prepend });
+  }
+
+  /** Publish BEFORE attaching: the views already there get the frame, the new
+   *  one gets the same revision once in its reply. */
+  const subscribeLive = async (entry, params, viewer, baseRevision) => {
+    await applyTranscriptRequest(entry, params, currentSessionId(entry) || String(params.sessionId || ''));
+    const prepend = params.transcriptPrepend === true;
+    let step = advanceForCaller(entry);
+    // Bounded like a read (boundedSessionResult), before attaching: the new
+    // view receives the restarted tail once, in its reply.
+    const bounds = transcriptAnswerBounds(requestedTranscriptWindow(params));
+    if (transcriptWindowOversized(entry, sessionResult(entry, step, baseRevision, {}, { prepend }).full, bounds)) {
+      restartTranscriptWindow(entry, bounds.maxItems);
+      step = advanceForCaller(entry);
+    }
+    addSubscriber(entry, viewer);
+    return sessionResult(entry, step, baseRevision, { subscribed: true }, { prepend });
+  };
+
+  return { applyTranscriptRequest, boundedSessionResult, subscribeLive };
+}
+
+/** Detaching a view from a live or cold session. */
+function createSessionUnsubscribe(ctx) {
+  const { log, externalViewEntries } = ctx;
+  const { externalEntryForView, sessionOwner } = ctx.projection;
+  const { subscriberToken, dropPendingViewer } = ctx.viewers;
+  const { sessionBusy, releaseProjection, startEvictionSweep } = ctx.retention;
+  const { destroy } = ctx.entries;
+  const { releaseStoredSession } = ctx.storedReader;
+
+  async function unsubscribeSession({ sessionId } = {}, viewer = null) {
+    const id = String(sessionId || '');
+    if (!id) throw new TypeError('sessionId is required');
+    const coldViewers = dropPendingViewer(id, viewer);
+    const owner = sessionOwner(id);
+    if (!owner) {
+      const external = externalEntryForView(id);
+      if (external) {
+        const token = subscriberToken(viewer);
+        if (token) external.subscribers?.delete(token);
+        if ((external.subscribers?.size || 0) === 0) externalViewEntries.delete(id);
+      }
+      // The last cold view left: its disk projection turns idle, kept within
+      // the store's idle budget so a revisit skips the parse.
+      if (!coldViewers) releaseStoredSession(id);
+      return { sessionId: id, unsubscribed: true };
+    }
+    const entry = owner;
+    const token = subscriberToken(viewer);
+    if (token) entry.subscribers?.delete(token);
+    if ((entry.subscribers?.size || 0) === 0) {
+      entry.transcriptView = null;
+      if (entry.reservedOnly && !sessionBusy(entry)) {
+        await destroy(entry, 'unclaimed session reservation', {
+          keepBackgroundWork: true,
+        });
+        return { sessionId: id, unsubscribed: true };
+      }
+      entry.retainedAt = Date.now();
+      releaseProjection(entry);
+      startEvictionSweep();
+    }
+    log(`session unsubscribed session=${id}${token ? ` client=${token}` : ''}`);
+    return { sessionId: id, unsubscribed: true };
+  }
+
+  return { unsubscribeSession };
+}
+
+export function createSessionViewCalls(ctx) {
+  const { readStoredSession, runSessionAction, advanceForCaller } = ctx;
+  const { externalEntryForView, projectionResult, unchangedProjectionResult, sessionOwner } = ctx.projection;
+  /** The owner a concurrent materialization may have produced while a disk
+   *  read was in flight: a daemon-owned runtime outranks an external view. */
+  const lateOwnerFor = (id) => sessionOwner(id) || externalEntryForView(id);
+  const { trackPendingViewer, dropPendingViewer, notePrependViewer } = ctx.viewers;
+  const { retainUnwatched } = ctx.retention;
+  const { assertAvailable, entryForSession, liveEntryForView, bindExternalSessionView } = ctx.entries;
+  const { storedSessionProjection, storedProjectionUnchanged, storedPageOnly, requestedMessageSlice } =
+    ctx.storedReader;
+  const { createSession } = createSessionCreation(ctx);
+  const { applyTranscriptRequest, boundedSessionResult, subscribeLive } = createLiveTranscriptAnswers(ctx);
+  const { unsubscribeSession } = createSessionUnsubscribe(ctx);
+
   async function liveSessionReadResult(entry, params, sessionId, baseRevision) {
     assertAvailable(entry);
     await applyTranscriptRequest(entry, params, sessionId);
@@ -110,11 +208,7 @@ export function createSessionViewCalls(ctx) {
     retainUnwatched(entry, 'headless session read');
     const messages = await requestedMessageSlice(params, sessionId);
     assertAvailable(entry);
-    const prepend = params.transcriptPrepend === true;
-    return transcriptPageBody(
-      sessionResult(entry, step, baseRevision, messages, { prepend }),
-      requestedHeldTranscript(params)
-    );
+    return boundedSessionResult(entry, step, params, baseRevision, messages);
   }
 
   /** The live entry a view can attach to: the owner, an external view, or a
@@ -146,6 +240,13 @@ export function createSessionViewCalls(ctx) {
       assertAvailable(live);
       return { range };
     }
+    const historyRequest = requestedTranscriptHistory(params);
+    if (historyRequest) {
+      // Read-only: no window, baseline or revision of any view moves.
+      const history = await readTranscriptHistory(live, id, readStoredSession, historyRequest);
+      assertAvailable(live);
+      return { history };
+    }
     if (live) {
       return liveSessionReadResult(live, params, id, baseRevision);
     }
@@ -162,7 +263,8 @@ export function createSessionViewCalls(ctx) {
         const lateOwner = lateOwnerFor(id);
         return lateOwner ? liveSessionReadResult(lateOwner, params, id, baseRevision) : held;
       }
-      const projection = await storedSessionProjection(id, openHints, window);
+      const heldRows = requestedHeldTranscript(params);
+      const projection = await storedSessionProjection(id, openHints, window, heldRows, baseProjectionStamp);
       assertAvailable();
       const lateOwner = lateOwnerFor(id);
       if (lateOwner) {
@@ -179,28 +281,18 @@ export function createSessionViewCalls(ctx) {
       });
       const messages = await requestedMessageSlice(params, id);
       assertAvailable();
-      return { ...transcriptPageBody(result, requestedHeldTranscript(params)), ...messages };
+      // The stored reader already proved (or disproved) the held rows, and
+      // its projection then carries only the page above them.
+      const page = storedPageOnly(projection)
+        ? transcriptPageBody(result, heldRows, { proven: true, byteBudget: window?.byteBudget, pageOnly: true })
+        : result;
+      return { ...page, ...messages };
     }
     // Embedders without a store reader keep the legacy load-on-read seam.
     const entry = await entryForSession(id, openHints || {});
     return liveSessionReadResult(entry, params, id, baseRevision);
   }
 
-  /** Publish BEFORE attaching: the views already there get the frame, the new
-   *  one gets the same revision once in its reply. */
-  const subscribeLive = async (entry, params, viewer, baseRevision) => {
-    await applyTranscriptRequest(entry, params, currentSessionId(entry) || String(params.sessionId || ''));
-    const step = advanceForCaller(entry);
-    addSubscriber(entry, viewer);
-    return sessionResult(
-      entry,
-      step,
-      baseRevision,
-      { subscribed: true },
-      { prepend: params.transcriptPrepend === true }
-    );
-  };
-
   async function subscribeSession(params = {}, viewer = null) {
     const { sessionId, open: openHints = {}, baseRevision = null } = params;
     assertAvailable();
@@ -236,41 +328,5 @@ export function createSessionViewCalls(ctx) {
     return subscribeLive(entry, params, viewer, baseRevision);
   }
 
-  async function unsubscribeSession({ sessionId } = {}, viewer = null) {
-    const id = String(sessionId || '');
-    if (!id) throw new TypeError('sessionId is required');
-    const coldViewers = dropPendingViewer(id, viewer);
-    const owner = sessionOwner(id);
-    if (!owner) {
-      const external = externalEntryForView(id);
-      if (external) {
-        const token = subscriberToken(viewer);
-        if (token) external.subscribers?.delete(token);
-        if ((external.subscribers?.size || 0) === 0) externalViewEntries.delete(id);
-      }
-      // The last cold view left: its disk projection turns idle, kept within
-      // the store's idle budget so a revisit skips the parse.
-      if (!coldViewers) releaseStoredSession(id);
-      return { sessionId: id, unsubscribed: true };
-    }
-    const entry = owner;
-    const token = subscriberToken(viewer);
-    if (token) entry.subscribers?.delete(token);
-    if ((entry.subscribers?.size || 0) === 0) {
-      entry.transcriptView = null;
-      if (entry.reservedOnly && !sessionBusy(entry)) {
-        await destroy(entry, 'unclaimed session reservation', {
-          keepBackgroundWork: true,
-        });
-        return { sessionId: id, unsubscribed: true };
-      }
-      entry.retainedAt = Date.now();
-      releaseProjection(entry);
-      startEvictionSweep();
-    }
-    log(`session unsubscribed session=${id}${token ? ` client=${token}` : ''}`);
-    return { sessionId: id, unsubscribed: true };
-  }
-
   return { createSession, readSession, subscribeSession, unsubscribeSession };
 }

package/src/standalone/session-service/session-calls/turn-gate.mjs

@@ -0,0 +1,34 @@
+// session-calls/turn-gate.mjs
+// The service's turn starts per session (a submit's intake, an approval that
+// resumes a turn, a materialization for a Goal or quota resume) against the
+// desktop's idle-only delete: the delete closes a session to new starts only
+// while none is being admitted, and a start refuses while it is closed.
+import { SessionClosedError } from '../../../runtime/agent/orchestrator/session/manager/session-errors.mjs';
+
+export function createSessionTurnGate() {
+  const starting = new Map(); // sessionId -> admissions in flight
+  const fenced = new Set();
+  return {
+    /** Admit a turn start of `sessionId`; the returned release ends it. */
+    enter(sessionId) {
+      if (fenced.has(sessionId)) {
+        throw new SessionClosedError(sessionId, 'session is being deleted', 'auto-retention-delete');
+      }
+      starting.set(sessionId, (starting.get(sessionId) || 0) + 1);
+      let left = false;
+      return () => {
+        if (left) return;
+        left = true;
+        const count = (starting.get(sessionId) || 1) - 1;
+        if (count > 0) starting.set(sessionId, count);
+        else starting.delete(sessionId);
+      };
+    },
+    /** Close `sessionId` to turn starts; null while one is being admitted. */
+    fence(sessionId) {
+      if (starting.has(sessionId) || fenced.has(sessionId)) return null;
+      fenced.add(sessionId);
+      return () => fenced.delete(sessionId);
+    },
+  };
+}

package/src/standalone/session-service/session-calls.mjs

@@ -14,6 +14,7 @@
 import { createSessionActionCalls } from './session-calls/session-action.mjs';
 import { createSessionTurnCalls } from './session-calls/session-turns.mjs';
 import { createSessionViewCalls } from './session-calls/session-views.mjs';
+import { createSessionTurnGate } from './session-calls/turn-gate.mjs';
 
 /**
  * @param {object} deps
@@ -54,7 +55,7 @@ export function createSessionCalls(deps) {
     return step;
   }
 
-  const ctx = { ...deps, sessionResult, responseSessionId, advanceForCaller };
+  const ctx = { ...deps, sessionResult, responseSessionId, advanceForCaller, turnGate: createSessionTurnGate() };
   const actions = createSessionActionCalls(ctx);
   const views = createSessionViewCalls({ ...ctx, runSessionAction: actions.runSessionAction });
   const turns = createSessionTurnCalls(ctx);