thinkpool-pair 0.7.29 → 0.7.31

package/account.mjs

@@ -14,6 +14,7 @@ import fs from 'node:fs'
 import { createClient } from '@supabase/supabase-js'
 import os from 'node:os'
 import { saveAuth, loadAuth, loadDirs, bindDir } from './auth-store.mjs'
+import { isSafeToRestart } from './update-gate.mjs'
 
 const VERSION = (() => { try { return JSON.parse(fs.readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version } catch { return null } })()
 
@@ -208,6 +209,9 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
 
   const children = new Map()   // room -> child process
   const childIdle = new Map()  // room -> bool (last idle report; unknown = not idle)
+  const childPeer = new Map()  // room -> bool (a web client is watching this room)
+  let applyRequested = false   // a user clicked "apply" in some room (Slice 3)
+  let pendingUpdate = null     // newest published version once the poll sees it
   const warned = new Set()
 
   // Account presence — so the web dashboard can show "● Bridge active" for this
@@ -277,8 +281,17 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
       delete env.THINKPOOL_PAIR_AUTOUPDATE
       const child = spawn(process.execPath, [BRIDGE, room, '--headless', '--auto=claude'], { cwd: dir, stdio: ['inherit', 'inherit', 'inherit', 'ipc'], env })
       children.set(room, child)
-      child.on('message', (m) => { if (m && m.t === 'idle') childIdle.set(room, !!m.idle) })
-      child.on('exit', () => { children.delete(room); childIdle.delete(room) })   // re-served on the next tick
+      childIdle.set(room, false)   // unknown until it reports → never restart a fresh child
+      childPeer.set(room, false)
+      child.on('message', (m) => {
+        if (!m) return
+        if (m.t === 'idle') { childIdle.set(room, !!m.idle); childPeer.set(room, !!m.webPeer) }
+        else if (m.t === 'apply-update') { applyRequested = true; applyIfIdle() }   // user clicked the chip
+      })
+      child.on('exit', () => { children.delete(room); childIdle.delete(room); childPeer.delete(room) })   // re-served on the next tick
+      // If an update is already pending, tell the freshly-served child immediately so
+      // its room shows the "update ready" chip without waiting for the next poll.
+      if (pendingUpdate) { try { child.send({ t: 'update-available', version: pendingUpdate }) } catch { /* child not ready */ } }
     }
     pushPresence()
   }
@@ -299,6 +312,16 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   }
   for (const sig of ['SIGINT', 'SIGTERM', 'SIGHUP']) process.on(sig, () => stop(sig))
 
+  // ── Slice 3 apply-gate (function scope so the child-IPC handler can call it) ──
+  // Restart the account bridge to apply a pending update ONLY when it's safe: every
+  // child idle (between turns) AND either a user clicked apply OR nobody's watching
+  // (unattended fallback). The predicate is unit-tested (tests/update-gate.test.mjs).
+  const applyIfIdle = () => {
+    if (!isSafeToRestart({ pendingUpdate, stopping, childIdle, childPeer, requested: applyRequested })) return
+    process.stderr.write(`\n  ◆ thinkpool-pair ${pendingUpdate} ready (running ${VERSION}) — restarting account bridge to update; sessions resume.\n`)
+    stop('SIGTERM')   // graceful: children persist + leave presence; exit 0 → service reruns @latest
+  }
+
   // ── auto-update (account-service tier only) ───────────────────────────────
   // launchd (KeepAlive) / systemd (Restart=always) re-run `npx -y
   // thinkpool-pair@latest` (no room) on every restart, so a clean exit here
@@ -312,7 +335,6 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
   //   THINKPOOL_PAIR_UPDATE_IDLE      child idle seconds before a restart (default 90)
   if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
     const POLL_MS = Math.max(60, parseInt(process.env.THINKPOOL_PAIR_UPDATE_INTERVAL, 10) || 1800) * 1000
-    let pendingUpdate = null
     // Strictly-newer x.y.z core; ignore prerelease tails (never downgrade/churn).
     const isNewer = (latest, cur) => {
       const core = (v) => String(v).split('-')[0].split('.').map((n) => parseInt(n, 10) || 0)
@@ -330,20 +352,15 @@ export async function runAccount(SUPABASE_URL, SUPABASE_ANON) {
         return typeof j?.version === 'string' ? j.version : null
       } catch { return null } finally { clearTimeout(to) }
     }
-    // Idle iff every served child has reported idle. No children → trivially idle.
-    // Unknown (no report yet) counts as NOT idle, so we never cycle a fresh child.
-    const allIdle = () => { for (const room of children.keys()) if (!childIdle.get(room)) return false; return true }
-    const applyIfIdle = () => {
-      if (!pendingUpdate || stopping || !allIdle()) return
-      process.stderr.write(`\n  ◆ thinkpool-pair ${pendingUpdate} ready (running ${VERSION}) — restarting account bridge to update; sessions resume.\n`)
-      stop('SIGTERM')   // graceful: children persist + leave presence; exit 0 → service reruns @latest
-    }
     const check = async () => {
       const latest = await fetchLatest()
       if (latest && isNewer(latest, VERSION)) {
-        if (!pendingUpdate) process.stderr.write(`\n  ◆ thinkpool-pair ${latest} published — will restart at the next idle moment (all sessions quiet).\n`)
+        if (!pendingUpdate) process.stderr.write(`\n  ◆ thinkpool-pair ${latest} published — "update ready" surfaced to each room; applies between turns.\n`)
         pendingUpdate = latest
-        applyIfIdle()
+        // Tell every served child so its room shows the chip (children never self-update;
+        // only this supervisor restart re-resolves @latest). Slice 3 nudge.
+        for (const c of children.values()) { try { c.send({ t: 'update-available', version: latest }) } catch { /* child not ready */ } }
+        applyIfIdle()   // unattended fallback fires here when no room has a web peer
       }
     }
     setInterval(check, POLL_MS).unref()

package/bridge.mjs

@@ -37,8 +37,9 @@ import { fileURLToPath } from 'node:url'
 import { randomUUID } from 'node:crypto'
 import { createClient } from '@supabase/supabase-js'
 import { startClaudeSession } from './claude-session.mjs'
+import { turnInFlight } from './update-gate.mjs'
 import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames } from './session-store.mjs'
-import { stampEvent } from './event-id.mjs'
+import { stampEvent, makeSeqCounter, maxSeq, seqable } from './event-id.mjs'
 
 // Public client creds (the same anon values the web app ships — safe to embed).
 // Override with TP_SUPABASE_URL / TP_SUPABASE_ANON if you ever need to.
@@ -366,6 +367,23 @@ let shuttingDown = false
 let lastActivity = Date.now()
 const markActivity = () => { lastActivity = Date.now() }
 
+// ── Slice 3: update-ready nudge state ──────────────────────────────
+// The newest published version once the update poll (service tier) or the account
+// supervisor (via IPC) reports one is out. Surfaced to the room as the "update
+// ready" chip; the restart is gated to between turns (never mid-turn, Contract #1).
+let pendingUpdate = null
+let applyRequested = false   // a user clicked "apply" in the room
+// A web client (not another bridge) is present — checks presence metas for a
+// non-bridge role. Gates the unattended auto-restart: when someone's watching we
+// wait for their apply click instead of restarting under them.
+const webPeerPresent = () => {
+  try {
+    const st = channel.presenceState() || {}
+    for (const metas of Object.values(st)) for (const m of (metas || [])) if (m && m.role !== 'bridge') return true
+  } catch { /* noop */ }
+  return false
+}
+
 const bcast = (event, payload) => {
   if (event === 'pty-out' || event === 'code-event') lastActivity = Date.now()
   try {
@@ -388,6 +406,9 @@ const announce = () =>
     // cwd + version: the host's working dir + thinkpool-pair version, shown in
     // the room's welcome banner. Re-sent per announce so late joiners get them.
     cwd, version: VERSION,
+    // pendingUpdate: a newer thinkpool-pair is out — drives the room's "update ready"
+    // chip; re-sent per announce so reloads/late-joiners see it (Slice 3).
+    pendingUpdate,
     // updir: where room file-drops land (forward-slash normalised — the web
     // client string-joins host paths onto it; Node accepts `/` on Windows).
     updir: UPDIR.split(path.sep).join('/'),
@@ -594,6 +615,20 @@ function printLocal(evt) {
   }
 }
 
+// Single stamp+append point for a structured session's replayed log. Assigns the
+// per-term contiguous seq (C1), appends, and caps at STRUCTURED_LOG_MAX (oldest
+// first). EVERY event that joins entry.log must go through here so the client's
+// "drop ≤ seqHi" cursor stays correct (a logged event with no seq would break it).
+function pushLog(entry, evt) {
+  // Only TRANSCRIPT events consume a seq (seqable) — replay-chrome kinds the web
+  // filters out (system/thinking_tokens/effort) ride the log seq-less so they don't
+  // hole the client's applied sequence. See event-id.mjs NO_SEQ_KINDS.
+  if (entry.seq && seqable(evt)) evt.seq = entry.seq.next()
+  entry.log.push(evt)
+  if (entry.log.length > STRUCTURED_LOG_MAX) entry.log.shift()
+  return evt
+}
+
 // The Phase-2 path: instead of a PTY, run Claude Code through the Agent SDK and
 // relay STRUCTURED events. onEvent → broadcast `code-event` + print locally +
 // persist to the host file; tool calls round-trip through the perm card; the
@@ -601,6 +636,11 @@ function printLocal(evt) {
 function openStructured({ id, model, resume, log, commands, mode }) {
   if (sessions.has(id)) return
   const entry = { cmd: 'claude', kind: 'structured', log: Array.isArray(log) ? log.slice(-STRUCTURED_LOG_MAX) : [], pending: new Map(), session: null, recovered: false, commands: Array.isArray(commands) ? commands : undefined, mode }
+  // C1 (RT-2): per-term contiguous seq counter. Seeded from the restored log's max
+  // so a bridge restart resumes ABOVE every persisted seq — fresh events never reuse
+  // an old seq, which is what keeps the between-turns restart dup-free (see
+  // event-id.mjs + src/pages/code/seqDedup.js). pushLog() is the single stamp point.
+  entry.seq = makeSeqCounter(maxSeq(entry.log))
   sessions.set(id, entry)
   // This session's private mockup outbox — render.sh writes manifests here (via
   // TP_MOCKUP_OUTBOX below) and the watcher attributes every card to THIS id, so
@@ -639,7 +679,10 @@ function openStructured({ id, model, resume, log, commands, mode }) {
       if (evt.kind === 'system' && Array.isArray(evt.commands) && evt.commands.length && !entry.commands) { entry.commands = evt.commands; announce(); persist() }
       // Chrome events (mode / usage / clear / compact) are transient state, not
       // transcript — broadcast + print them but keep out of the persisted/replayed log.
-      const chrome = evt.kind === 'mode' || evt.kind === 'usage' || evt.kind === 'clear' || evt.kind === 'compact'
+      // 'stalled' is transient turn-liveness state (would replay as a stale frozen
+      // banner if persisted); 'compaction' is a real transcript milestone (the recap
+      // card) and is intentionally NOT chrome, so it persists + replays.
+      const chrome = evt.kind === 'mode' || evt.kind === 'usage' || evt.kind === 'clear' || evt.kind === 'compact' || evt.kind === 'stalled'
       // compact turn finished (or errored) → clear the pulsing indicator.
       // No "done" ctl line — the SDK's own output in the transcript is the
       // signal (compact summary on success, AbortError text on abort/too-small).
@@ -647,10 +690,7 @@ function openStructured({ id, model, resume, log, commands, mode }) {
         entry.compacting = false
         bcast('code-event', { term: id, evt: { kind: 'compact', status: 'done', ts: Date.now() } })
       }
-      if (!chrome) {
-        entry.log.push(evt)
-        if (entry.log.length > STRUCTURED_LOG_MAX) entry.log.shift()
-      }
+      if (!chrome) pushLog(entry, evt)
       bcast('code-event', { term: id, evt })
       printLocal(evt)
       if (!chrome) persist()
@@ -702,6 +742,16 @@ function endStructured(id) {
   if (s) announce()
 }
 
+// Slice 3 — surface a pending update to the room as the "update ready" chip:
+// broadcast a chrome code-event per structured term + stash it on the announce so
+// reloads/late-joiners see it too. The restart itself is gated to between turns.
+function surfaceUpdate(version) {
+  if (!version || pendingUpdate === version) return
+  pendingUpdate = version
+  for (const id of sessions.keys()) bcast('code-event', { term: id, evt: { kind: 'update-available', version } })
+  announce()
+}
+
 // After the attached CLI exits, the host's stdin stops feeding a PTY —
 // restore the cooked terminal so Ctrl-C reaches the bridge itself.
 const detachLocal = () => {
@@ -797,9 +847,17 @@ channel
       })
     }
     // Structured sessions replay their event log (reader rebuilds from it).
+    // C1 (RT-2): send only the tail past the client's per-term cursor (seqHi) when
+    // it supplies one — the authoritative replay-from-cursor that supersedes
+    // re-sending + re-merging the whole log on every reconnect. Events with no seq
+    // (legacy/pre-C1 logs) ride along always; the client cid-dedups those and
+    // additionally drops ≤ seqHi, so an over-send is harmless. A fresh joiner (no
+    // cursor) still gets the full log.
     for (const [id, s] of sessions) {
       if (!s.log.length) continue
-      bcast('code-replay', { to: payload?.to ?? null, term: id, events: s.log })
+      const from = Number(payload?.cursors?.[id]) || 0
+      const events = from > 0 ? s.log.filter((e) => e.seq == null || e.seq > from) : s.log
+      bcast('code-replay', { to: payload?.to ?? null, term: id, events })
     }
     // Re-send any still-pending permission/question cards. They ride a one-shot
     // code-perm-req broadcast (NOT the replayed event log), so a reconnect/refresh
@@ -847,7 +905,7 @@ channel
     const echoYou = () => {
       if (payload.silent) return
       const evt = { kind: 'you', text, cid: payload.cid, by: payload.by }
-      s.log.push(evt); if (s.log.length > STRUCTURED_LOG_MAX) s.log.shift()
+      pushLog(s, evt)
       bcast('code-event', { term: payload.term, evt })
     }
     // Session controls (/model, /clear) are NOT agent turns — they change the
@@ -857,7 +915,7 @@ channel
     // slash still flow through as a real, self-terminating turn.
     const ctlLine = (ctlText) => {
       const evt = { kind: 'control', text: ctlText, by: payload.by, cid: payload.cid }
-      s.log.push(evt); if (s.log.length > STRUCTURED_LOG_MAX) s.log.shift()
+      pushLog(s, evt)
       bcast('code-event', { term: payload.term, evt })
     }
     const mm = text.match(/^\/model\b\s*(\S+)?/)
@@ -868,7 +926,7 @@ channel
     }
     if (/^\/clear\s*$/.test(text)) {
       s.session.sendTurn(text)
-      s.log = []; bcast('code-event', { term: payload.term, evt: { kind: 'clear' } })
+      s.log = []; s.seq = makeSeqCounter(0); bcast('code-event', { term: payload.term, evt: { kind: 'clear' } })
       flushSession(room, payload.term, { sessionId: s.session?.sessionId || null, log: [] })
       ctlLine('context cleared. You can continue with these answers in mind.')
       return
@@ -904,6 +962,18 @@ channel
   .on('broadcast', { event: 'code-close' }, ({ payload }) => {
     endStructured(payload?.id)
   })
+  // Slice 3 — the user clicked "apply" on the update chip. Mark it requested; the
+  // actual restart is gated to between turns. Account-child: forward to the
+  // supervisor (it owns the restart, applied only when every child is idle).
+  // Standalone service tier: its applyIfIdle loop lands it at the next idle. Either
+  // way it never interrupts a turn (Contract #1).
+  .on('broadcast', { event: 'apply-update' }, () => {
+    if (!pendingUpdate) return
+    applyRequested = true
+    if (process.send && process.env.THINKPOOL_PAIR_ACCOUNT_CHILD === '1') {
+      try { process.send({ t: 'apply-update' }) } catch { /* parent gone */ }
+    }
+  })
   // Persist + re-announce terminal renames. The web also echoes term-rename to
   // online peers directly; storing it here is what reaches a device that joins
   // LATER (or a second machine) — those only ever see the announce.
@@ -985,9 +1055,9 @@ setInterval(() => {
 if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
   const POLL_MS = Math.max(60, parseInt(process.env.THINKPOOL_PAIR_UPDATE_INTERVAL, 10) || 1800) * 1000
   const IDLE_MS = Math.max(10, parseInt(process.env.THINKPOOL_PAIR_UPDATE_IDLE, 10) || 90) * 1000
-  let pendingUpdate = null   // the newer version string, once seen
-
+  // pendingUpdate is module-level now (shared with surfaceUpdate + the room chip).
   const isIdle = () => {
+    if (turnInFlight(sessions)) return false                  // a structured turn is live
     if (Date.now() - lastActivity < IDLE_MS) return false
     for (const t of terms.values()) if (t.buf) return false   // bytes mid-flush
     return true
@@ -1011,14 +1081,18 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
   }
   const applyIfIdle = () => {
     if (!pendingUpdate || !isIdle()) return
+    // Slice 3: when a web client is watching, wait for their "apply" click instead
+    // of restarting under them. With nobody present (cloud VM / closed tab) the
+    // unattended fallback still auto-applies at idle so headless boxes self-heal.
+    if (!applyRequested && webPeerPresent()) return
     process.stderr.write(`\n  ◆ thinkpool-pair ${pendingUpdate} ready (running ${VERSION}) — restarting to update; the session resumes.\n`)
     shutdown(0, false)   // clean teardown (no farewell banner); service reruns @latest, session-store resumes
   }
   const check = async () => {
     const latest = await fetchLatest()
     if (latest && isNewer(latest, VERSION)) {
-      if (!pendingUpdate) process.stderr.write(`\n  ◆ thinkpool-pair ${latest} published — will restart at the next idle moment.\n`)
-      pendingUpdate = latest
+      if (!pendingUpdate) process.stderr.write(`\n  ◆ thinkpool-pair ${latest} published — "update ready" in the room; applies between turns.\n`)
+      surfaceUpdate(latest)   // sets pendingUpdate + broadcasts the chip + re-announces
       applyIfIdle()
     }
   }
@@ -1032,11 +1106,16 @@ if (process.env.THINKPOOL_PAIR_AUTOUPDATE === '1' && VERSION) {
   // the supervisor can pick a moment when EVERY child is idle to restart-update.
   const IDLE_MS = Math.max(10, parseInt(process.env.THINKPOOL_PAIR_UPDATE_IDLE, 10) || 90) * 1000
   const idleNow = () => {
+    if (turnInFlight(sessions)) return false                  // a structured turn is live
     if (Date.now() - lastActivity < IDLE_MS) return false
     for (const t of terms.values()) if (t.buf) return false   // bytes mid-flush
     return true
   }
-  setInterval(() => { try { process.send({ t: 'idle', idle: idleNow() }) } catch { /* parent gone */ } }, 5000).unref()
+  // The supervisor owns updates (children never self-update). It IPCs us when a newer
+  // version is out → surface the chip; we report idle + whether a web peer is present
+  // so it restarts only between turns and only when nobody is mid-click (Slice 3).
+  process.on('message', (m) => { if (m && m.t === 'update-available') surfaceUpdate(m.version) })
+  setInterval(() => { try { process.send({ t: 'idle', idle: idleNow(), webPeer: webPeerPresent() }) } catch { /* parent gone */ } }, 5000).unref()
 } else if (VERSION) {
   // Foreground run (not the supervised service): it can't self-restart, but
   // nudge once if a newer version is out so a relaunch with @latest picks it up.

package/claude-session.mjs

@@ -141,8 +141,24 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
   // per turn on `result`.
   let turnBaseOut = 0             // output tokens from completed messages this turn
   let curMsgOut = 0               // latest output_tokens for the in-flight message
+  // ── stall watchdog (C2) — stream silence ≠ done; a turn can stall (deltas pause
+  // 3+ min) or abort silently with no `result`. Track turn liveness + last event
+  // time; if an active turn goes quiet past STALL_MS, emit one `stalled` chrome
+  // event so the room can stop showing a frozen "working" forever. Cleared on the
+  // next event / `result`. Refs: TS SDK #44, claude-code #38905.
+  const STALL_MS = Math.max(30000, parseInt(process.env.TP_STALL_MS, 10) || 120000)
+  let turnActive = false          // true between a sent turn and its `result`
+  let lastEvtTs = Date.now()      // wall-clock of the most recent emitted event
+  let stalledSent = false         // one `stalled` per stall, not a storm
 
-  const emit = (evt) => { try { onEvent?.(evt) } catch { /* never let a consumer throw into the loop */ } }
+  const emit = (evt) => { lastEvtTs = Date.now(); if (evt && evt.kind !== 'stalled') stalledSent = false; try { onEvent?.(evt) } catch { /* never let a consumer throw into the loop */ } }
+  const stallTimer = setInterval(() => {
+    if (turnActive && !stalledSent && Date.now() - lastEvtTs > STALL_MS) {
+      stalledSent = true
+      emit({ kind: 'stalled', sinceMs: Date.now() - lastEvtTs })
+    }
+  }, 5000)
+  stallTimer.unref?.()
 
   // Apply a permission-mode change to the live SDK *outside* any hook callback.
   // setPermissionMode is a streaming control request; awaiting it from INSIDE the
@@ -319,6 +335,13 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
               if (turnBaseOut + curMsgOut === 0) emit({ kind: 'thinking_tokens', tokens: m.estimated_tokens, delta: m.estimated_tokens_delta })
               break
             }
+            // compact_boundary — the authoritative compaction event (replaces the
+            // old heuristic): trigger ('manual' for /compact vs 'auto') + the token
+            // count before compaction. Emit a real recap card the room can pin.
+            if (m.subtype === 'compact_boundary') {
+              emit({ kind: 'compaction', trigger: m.compact_metadata?.trigger || 'auto', preTokens: m.compact_metadata?.pre_tokens ?? null })
+              break
+            }
             if (m.session_id) sessionId = m.session_id
             // m.slash_commands (init message) — the commands this session really
             // supports: built-ins + the host's custom .claude/commands. Surfaced
@@ -330,7 +353,10 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
             for (const b of (m.message?.content || [])) {
               if (b?.type === 'tool_use' && b.id) toolStart.set(b.id, Date.now())
             }
-            emit({ kind: 'assistant', blocks: simplifyBlocks(m.message?.content) })
+            // parentToolUseId: non-null when this assistant message comes from a
+            // sub-agent (Task tool) — the universal nesting spine. Thread it so the
+            // room can group sub-agent activity under its parent Task card.
+            emit({ kind: 'assistant', blocks: simplifyBlocks(m.message?.content), parentToolUseId: m.parent_tool_use_id || null })
             break
           case 'user':
             // tool_result blocks arrive on the user-role echo
@@ -338,7 +364,7 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
               if (b?.type === 'tool_result') {
                 const start = toolStart.get(b.tool_use_id)
                 if (start != null) toolStart.delete(b.tool_use_id)
-                emit({ kind: 'tool_result', toolUseId: b.tool_use_id, content: b.content, isError: !!b.is_error, durationMs: start != null ? Date.now() - start : undefined })
+                emit({ kind: 'tool_result', toolUseId: b.tool_use_id, content: b.content, isError: !!b.is_error, durationMs: start != null ? Date.now() - start : undefined, parentToolUseId: m.parent_tool_use_id || null })
               }
             }
             break
@@ -361,7 +387,8 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
           case 'result':
             if (m.session_id) sessionId = m.session_id
             turnBaseOut = 0; curMsgOut = 0   // reset the live token count for the next turn
-            emit({ kind: 'result', subtype: m.subtype, sessionId, costUsd: m.total_cost_usd, usage: m.usage, numTurns: m.num_turns })
+            turnActive = false               // turn settled → stall watchdog stands down
+            emit({ kind: 'result', subtype: m.subtype, sessionId, costUsd: m.total_cost_usd, usage: m.usage, numTurns: m.num_turns, durationMs: m.duration_ms ?? null, denials: Array.isArray(m.permission_denials) ? m.permission_denials.length : 0 })
             // Surface a usage/context meter (chrome, not a transcript line). The
             // context window % comes from the control request; cost is cumulative.
             ;(async () => {
@@ -384,7 +411,7 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
   })()
 
   return {
-    sendTurn(text) { if (!closed) input.push(String(text)) },
+    sendTurn(text) { if (!closed) { turnActive = true; lastEvtTs = Date.now(); stalledSent = false; input.push(String(text)) } },
     // Set the permission mode — Claude Code's ⇧⇥ cycle. setPermissionMode is a
     // streaming control request (drives plan-mode behaviour SDK-side); the local
     // `mode` drives our PreToolUse auto-approve policy. Echo so the room syncs.
@@ -412,8 +439,9 @@ export function startClaudeSession({ cwd, model, resume, env, mode: initialMode
     // Graceful interrupt (Esc / Stop) — stops the current turn but keeps the
     // session alive for the next one. ac.abort() is teardown only (end()).
     async abort() { try { await q?.interrupt?.() } catch { /* noop */ } },
-    end() { closed = true; input.end(); try { ac.abort() } catch { /* noop */ } },
+    end() { closed = true; clearInterval(stallTimer); input.end(); try { ac.abort() } catch { /* noop */ } },
     get sessionId() { return sessionId },
     get mode() { return mode },
+    get turnActive() { return turnActive },   // a turn is in flight (gates between-turns update restart — Slice 3 Contract #1)
   }
 }

package/event-id.mjs

@@ -27,3 +27,43 @@ export function stampEvent(evt, gen = randomUUID) {
   if (!evt.cid) evt.cid = gen()
   return evt
 }
+
+/* C1 (RT-2): a per-term monotonic, CONTIGUOUS sequence counter. Every event that
+   enters a session's replayed log gets `seq = counter.next()`, so the web room can
+   replay-from-cursor and dedup by "drop ≤ seqHi" instead of re-merging the whole
+   log by cid on every reconnect (see src/pages/code/seqDedup.js).
+
+   THE restart property (what makes Slice 3's between-turns restart dup-free): when a
+   bridge restart restores a persisted log, seed the counter from maxSeq(log) so the
+   NEXT seq is strictly above every restored seq. Reusing an old seq would make the
+   client drop the fresh event as a duplicate. */
+export function makeSeqCounter(startAfter = 0) {
+  let n = Number.isFinite(startAfter) ? startAfter : 0
+  return {
+    next: () => ++n,
+    bumpTo: (m) => { if (Number.isFinite(m) && m > n) n = m },
+    current: () => n,
+  }
+}
+
+// Kinds the bridge logs for the live transcript but that the WEB treats as
+// replay-chrome (src/pages/code/code-constants.js REPLAY_CHROME): filtered out of
+// the replay + handled as transient state, never applied as a transcript line. They
+// must NOT consume a per-term seq — the client advances its cursor (seqHi) ONLY over
+// transcript events, so a seq on one of these would leave a hole in the applied
+// sequence → the client sees a false gap → spurious resync storms. So the counter
+// skips them and they ride the log seq-less (the client cid-handles/ignores them).
+// MUST stay a subset of REPLAY_CHROME ∩ {kinds the bridge logs} — guarded by
+// bridge/test-seq.mjs S6. (mode/usage/clear/compact/stalled are bridge-chrome and
+// never logged at all, so they never reach the counter.)
+export const NO_SEQ_KINDS = new Set(['system', 'thinking_tokens', 'effort'])
+export const seqable = (evt) => !!evt && typeof evt === 'object' && !NO_SEQ_KINDS.has(evt.kind)
+
+// Highest numeric `seq` across a log of events (0 when none) — the floor a restored
+// session's counter resumes above.
+export function maxSeq(events) {
+  if (!Array.isArray(events)) return 0
+  let m = 0
+  for (const e of events) if (e && typeof e.seq === 'number' && e.seq > m) m = e.seq
+  return m
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.29",
+  "version": "0.7.31",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -10,6 +10,7 @@
     "bridge.mjs",
     "launcher.mjs",
     "claude-session.mjs",
+    "update-gate.mjs",
     "event-id.mjs",
     "transcript-sanitize.mjs",
     "session-store.mjs",

package/update-gate.mjs

@@ -0,0 +1,31 @@
+/* update-gate.mjs — pure predicates for the between-turns update apply (Slice 3
+   nudge protocol, spec docs/specs/2026-06-19-bridge-unified-launcher.md Part 2).
+
+   Extracted import-safe so the "safe to restart now" rule is unit-tested and can't
+   drift. Contract #1: an update only applies at idle / between turns — never mid-turn.
+   bridge.mjs runs the bridge on import (can't be imported by a test), so the gate
+   lives here. */
+
+// Supervisor side: is it safe to restart the account bridge to apply a pending
+// update? True iff a pending update exists, we're not already stopping, EVERY served
+// child is idle (a child reports idle=false while a turn is in flight — that's what
+// keeps Contract #1), AND either a user requested apply (clicked the chip) OR — the
+// unattended fallback — no child has a web peer present (nobody is there to click).
+export function isSafeToRestart({ pendingUpdate, stopping = false, childIdle, childPeer, requested = false }) {
+  if (!pendingUpdate || stopping) return false
+  for (const idle of childIdle.values()) if (!idle) return false      // any busy child → wait (between-turns)
+  if (requested) return true                                          // user clicked apply + all idle → go
+  for (const present of childPeer.values()) if (present) return false // someone's watching, no click → wait
+  return true                                                         // unattended: idle + nobody watching → auto-apply
+}
+
+// Child/standalone side: is any structured session mid-turn? Used both to gate a
+// local apply and to make the idle heartbeat honest (idle=false while a turn runs).
+// Accepts a sessions Map whose entries expose turnActive directly or via .session.
+export function turnInFlight(sessions) {
+  for (const s of (sessions?.values?.() || [])) {
+    const ta = s && (typeof s.session?.turnActive === 'boolean' ? s.session.turnActive : s.turnActive)
+    if (ta) return true
+  }
+  return false
+}