Fold gate blocked-ness into turn state so the stall watchdog sees it

The painter derived a local "blocked" turn from shell.overlayKind and
the stall check read the shared bag.turn straight, so the exemption
never reached the watchdog: an operator reading an approval for the
duration of the stall timeout got the run aborted underneath them.
Gates still queued behind another overlay were worse off, since
overlayKind reflects whatever else is on screen.

Turn state now carries a blocked-gate count, incremented the moment a
gate is raised (queued or displayed alike) and decremented when it
resolves, driven directly off the gate-wire lifecycle rather than the
shell's overlay. The painter and the watchdog both read that one
field instead of each re-deriving blocked-ness on their own.

Author: TheGreatAxios

src/tui-opentui/gate-wire.ts

@@ -227,13 +227,33 @@ function recordDecision(
   appendStreamRow(shell, { role: "system", text, meta: "permission" })
 }
 
+/**
+ * Blocked-ness is domain state, not a paint detail: the turn watchdog and the
+ * painter both need to know a gate is outstanding, whether or not it has
+ * reached the screen yet. This is the only place that sees a gate's full
+ * lifecycle (raised, possibly queued, eventually resolved), so it is the one
+ * that reports it — callers fold the pair into their own turn state.
+ */
+export type GateLifecycleHooks = {
+  /** A gate was raised — queued or opened, whichever comes first. */
+  readonly onGateOpened: () => void
+  /** A previously raised gate resolved. */
+  readonly onGateClosed: () => void
+}
+
+const NOOP_GATE_HOOKS: GateLifecycleHooks = {
+  onGateOpened: () => {},
+  onGateClosed: () => {},
+}
+
 /**
  * Subscribe the permission/operator gate events to the shell's overlays.
  * Returns a dispose function that removes exactly the listeners this call added.
  */
 export function wireGates(
   emitter: EventEmitter,
   shell: AppShell,
+  hooks: GateLifecycleHooks = NOOP_GATE_HOOKS,
 ): () => void {
   // The shell has one overlay host, and opening onto a busy one is a no-op.
   // Gates cannot be dropped that way — a lost ask_operator blocks the run with
@@ -255,6 +275,15 @@ export function wireGates(
   })
 
   function onPermission(ev: PermissionGateEvent): void {
+    hooks.onGateOpened()
+    let closed = false
+    const resolve: PermissionGateEvent["resolve"] = (outcome) => {
+      if (!closed) {
+        closed = true
+        hooks.onGateClosed()
+      }
+      ev.resolve(outcome)
+    }
     const choices = permissionChoicesFromRequest(ev.request)
     const collapsedBody = permissionBodyFromRequest(ev.request, { hint: true })
     // Nothing was collapsed → no expand affordance, so the overlay leaves the
@@ -299,15 +328,15 @@ export function wireGates(
             ...(sel.id !== undefined ? { id: sel.id } : {}),
           }
           recordDecision(shell, ev.request, choices, gateSelection)
-          ev.resolve(approvalOutcomeFromSelection(choices, gateSelection))
+          resolve(approvalOutcomeFromSelection(choices, gateSelection))
         },
         // Esc must settle the awaited promise (as a deny), not abandon it —
         // an unresolved gate hangs the run until the process is killed.
         onCancel: () => {
           if (settled) return
           settled = true
           clearTimers()
-          ev.resolve(
+          resolve(
             approvalOutcomeFromSelection(choices, {
               index: 0,
               id: PERMISSION_DENY_ID,
@@ -338,7 +367,7 @@ export function wireGates(
         const idx = pending.indexOf(open)
         if (idx >= 0) pending.splice(idx, 1)
       }
-      ev.resolve({ allow: false, message })
+      resolve({ allow: false, message })
     }
     function onAbort(): void {
       autoDeny("tool no longer running; permission request denied")
@@ -358,6 +387,15 @@ export function wireGates(
   }
 
   function onOperator(ev: OperatorGateEvent): void {
+    hooks.onGateOpened()
+    let closed = false
+    const resolve: OperatorGateEvent["resolve"] = (result) => {
+      if (!closed) {
+        closed = true
+        hooks.onGateClosed()
+      }
+      ev.resolve(result)
+    }
     const choices = operatorChoicesFromOptions(ev.options)
     // Guarded the same way as the permission gate: correctness must not rest
     // on callers of closeInsetOverlay remembering to null the cancel hook
@@ -371,7 +409,7 @@ export function wireGates(
       onAccept: (sel: OverlaySelection) => {
         if (settled) return
         settled = true
-        ev.resolve(
+        resolve(
           operatorResultFromSelection(ev.options, {
             index: sel.index,
             ...(sel.id !== undefined ? { id: sel.id } : {}),
@@ -383,14 +421,14 @@ export function wireGates(
       onTextAnswer: (text: string) => {
         if (settled) return
         settled = true
-        ev.resolve(operatorCustomResult(text))
+        resolve(operatorCustomResult(text))
       },
       // Esc must settle the awaited promise (as a cancel), not abandon it —
       // an unresolved gate hangs the run until the process is killed.
       onCancel: () => {
         if (settled) return
         settled = true
-        ev.resolve(operatorCancelResult())
+        resolve(operatorCancelResult())
       },
     }))
   }

src/tui-opentui/product-host.ts

@@ -486,7 +486,10 @@ export async function mountProductHost(
   // leave the terminal wedged with nobody able to restore it.
   let disposeGates: () => void
   try {
-    disposeGates = wireGates(config.eventEmitter, shell)
+    disposeGates = wireGates(config.eventEmitter, shell, {
+      onGateOpened: () => bridge.gateOpened(),
+      onGateClosed: () => bridge.gateClosed(),
+    })
   } catch (err: unknown) {
     try {
       renderer.destroy()

src/tui-opentui/runtime-bridge.ts

@@ -54,7 +54,8 @@ import {
   clearQuotaWait,
   initialTurnState,
   turnStateFromEvent,
-  turnStateBlocked,
+  turnStateGateClosed,
+  turnStateGateOpened,
   turnStateOnInterrupt,
   turnStateOnSubmit,
   type TurnState,
@@ -161,6 +162,14 @@ export type SessionBridge = {
     attachments?: readonly PendingImageAttachment[],
   ) => void
   interrupt: () => void
+  /**
+   * A permission or operator gate was raised — queued or already displayed.
+   * Blocks the turn (and exempts it from the stall watchdog) until a matching
+   * `gateClosed` call. Multiple outstanding gates nest correctly.
+   */
+  gateOpened: () => void
+  /** A previously raised gate resolved. */
+  gateClosed: () => void
   dispose: () => void
   /** Current derived turn phase (progress label, stall clock, quota window). */
   readonly turn: TurnState
@@ -748,11 +757,7 @@ export function attachSessionBridge(
   }
 
   const paintPhase = (): void => {
-    // The gate overlay is the only "blocked" signal the shell sees; the gate
-    // wiring resolves approvals itself and emits no bridge event.
-    const gated =
-      shell.overlayKind === "permissions" || shell.overlayKind === "operator"
-    const turn = gated ? turnStateBlocked(bag.turn) : bag.turn
+    const turn = bag.turn
     // The landing mark rides this same re-entry: it animates through the
     // draw/fill loop while a turn is live and holds its filled frame otherwise.
     paintLanding(shell, now(), turn.isProcessing)
@@ -893,6 +898,24 @@ export function attachSessionBridge(
     paintPhase()
   }
 
+  /**
+   * A permission or operator gate was raised — queued or already on screen,
+   * the turn does not distinguish. Called from the gate wiring itself, not
+   * derived from `shell.overlayKind`, so a gate still waiting behind another
+   * overlay exempts the turn from the stall watchdog just as an open one does.
+   */
+  const gateOpened = (): void => {
+    if (bag.disposed) return
+    bag.turn = turnStateGateOpened(bag.turn)
+    paintPhase()
+  }
+
+  const gateClosed = (): void => {
+    if (bag.disposed) return
+    bag.turn = turnStateGateClosed(bag.turn, now())
+    paintPhase()
+  }
+
   const tick = (): void => {
     if (bag.disposed) return
     const nowMs = now()
@@ -994,6 +1017,8 @@ export function attachSessionBridge(
     },
     submit,
     interrupt: doInterrupt,
+    gateOpened,
+    gateClosed,
     get turn() {
       return bag.turn
     },

src/tui-opentui/turn-monitor.test.ts

@@ -227,6 +227,7 @@ describe("turn progress label", () => {
       try {
         t.bridge.handle({ type: "inference.start", data: {} })
         t.shell.overlayKind = "permissions"
+        t.bridge.gateOpened()
         t.tick()
         expect(t.shell.turnPhase).toEndWith("blocked")
 
@@ -347,6 +348,48 @@ describe("stall watchdog", () => {
     })
   })
 
+  test("an open gate is exempt no matter how long the operator takes", async () => {
+    await withTestRenderer(async (h) => {
+      const t: Harness = await setup(h)
+      try {
+        t.bridge.submit("build it", "immediate")
+        t.port.clear()
+        t.bridge.gateOpened()
+
+        // Far past the stall timeout — an operator reading an approval must
+        // never have the run torn down underneath them.
+        t.advance(20 * 60_000)
+        t.tick()
+        expect(t.port.calls).toEqual([])
+        expect(t.shell.statusFlash).not.toBe(STALL_NOTICE_MESSAGE)
+      } finally {
+        t.bridge.dispose()
+      }
+    })
+  })
+
+  test("a gate queued but not yet displayed gets the same exemption", async () => {
+    await withTestRenderer(async (h) => {
+      const t: Harness = await setup(h)
+      try {
+        t.bridge.submit("build it", "immediate")
+        t.port.clear()
+        // The gate is raised but nothing else has changed `shell.overlayKind`
+        // — this is the "queued behind another overlay" shape from
+        // gate-wire.ts, where the gate is not nominally displayed yet.
+        t.bridge.gateOpened()
+        expect(t.shell.overlayKind).toBeNull()
+
+        t.advance(20 * 60_000)
+        t.tick()
+        expect(t.port.calls).toEqual([])
+        expect(t.shell.statusFlash).not.toBe(STALL_NOTICE_MESSAGE)
+      } finally {
+        t.bridge.dispose()
+      }
+    })
+  })
+
   test("a live tool run is not treated as a stall", async () => {
     await withTestRenderer(async (h) => {
       const t: Harness = await setup(h)

src/tui-opentui/turn-state.test.ts

@@ -2,8 +2,9 @@ import { describe, expect, test } from "bun:test"
 
 import {
   initialTurnState,
-  turnStateBlocked,
   turnStateFromEvent,
+  turnStateGateClosed,
+  turnStateGateOpened,
   turnStateOnInterrupt,
   turnStateOnSubmit,
 } from "./turn-state.js"
@@ -184,9 +185,26 @@ describe("turn transitions", () => {
   })
 
   test("gate blocks without ending the turn", () => {
-    const s = turnStateBlocked(turnStateOnSubmit(initialTurnState(0), 1))
+    const s = turnStateGateOpened(turnStateOnSubmit(initialTurnState(0), 1))
     expect(s.status).toBe("blocked")
     expect(s.isProcessing).toBe(true)
+    expect(s.blockedGateCount).toBe(1)
+  })
+
+  test("a second queued gate keeps the turn blocked until both clear", () => {
+    const running = turnStateOnSubmit(initialTurnState(0), 1)
+    const bothOpen = turnStateGateOpened(turnStateGateOpened(running))
+    expect(bothOpen.status).toBe("blocked")
+    expect(bothOpen.blockedGateCount).toBe(2)
+
+    const oneClosed = turnStateGateClosed(bothOpen, 5)
+    expect(oneClosed.status).toBe("blocked")
+    expect(oneClosed.blockedGateCount).toBe(1)
+
+    const allClosed = turnStateGateClosed(oneClosed, 9)
+    expect(allClosed.status).toBe("running")
+    expect(allClosed.blockedGateCount).toBe(0)
+    expect(allClosed.lastActivityAt).toBe(9)
   })
 })
 

src/tui-opentui/turn-state.ts

@@ -135,6 +135,16 @@ export type TurnState = {
    * gets long enough to trip `detectRepetition` on its own.
    */
   readonly consecutiveMatchingCycles: number
+  /**
+   * Outstanding approval/operator gates, counted from the moment each is
+   * raised — queued behind another overlay or already on screen, both count.
+   * `status` reads "blocked" whenever this is above zero, which is what
+   * exempts the turn from the stall watchdog: an operator reading a prompt
+   * must be indistinguishable from a live tool call as far as the silence
+   * clock is concerned. Painter and watchdog both read this one field rather
+   * than each re-deriving blocked-ness from the shell's overlay.
+   */
+  readonly blockedGateCount: number
 }
 
 export function initialTurnState(nowMs: number): TurnState {
@@ -155,6 +165,7 @@ export function initialTurnState(nowMs: number): TurnState {
     repeatingSinceTokenCount: null,
     cycleFingerprint: null,
     consecutiveMatchingCycles: 0,
+    blockedGateCount: 0,
   }
 }
 
@@ -177,6 +188,7 @@ export function turnStateOnSubmit(state: TurnState, nowMs: number): TurnState {
     repeatingSinceTokenCount: null,
     cycleFingerprint: null,
     consecutiveMatchingCycles: 0,
+    blockedGateCount: 0,
   }
 }
 
@@ -185,9 +197,36 @@ export function turnStateOnInterrupt(_state: TurnState, nowMs: number): TurnStat
   return { ...initialTurnState(nowMs), status: "stopped" }
 }
 
-/** A pending approval gate blocks the turn without ending it. */
-export function turnStateBlocked(state: TurnState): TurnState {
-  return { ...state, status: "blocked", isProcessing: true }
+/**
+ * A gate was raised — queued or opened, the turn does not distinguish.
+ * The first outstanding gate blocks the turn without ending it; further
+ * gates just add to the count so the turn stays blocked until all clear.
+ */
+export function turnStateGateOpened(state: TurnState): TurnState {
+  const blockedGateCount = state.blockedGateCount + 1
+  return {
+    ...state,
+    status: "blocked",
+    isProcessing: true,
+    blockedGateCount,
+  }
+}
+
+/**
+ * A gate resolved. Only the last outstanding gate clearing returns the turn
+ * to "running" — earlier ones just decrement the count. `lastActivityAt`
+ * moves to `nowMs` so the stall clock restarts from the moment the operator
+ * actually answered, rather than crediting silence spent reading the prompt.
+ */
+export function turnStateGateClosed(state: TurnState, nowMs: number): TurnState {
+  const blockedGateCount = Math.max(0, state.blockedGateCount - 1)
+  if (blockedGateCount > 0) return { ...state, blockedGateCount }
+  return {
+    ...state,
+    status: state.status === "blocked" ? "running" : state.status,
+    lastActivityAt: nowMs,
+    blockedGateCount,
+  }
 }
 
 export function clearQuotaWait(state: TurnState): TurnState {