From 930126b35c37ceca546475664806db71ffcc122b Mon Sep 17 00:00:00 2001
From: Michael B Reiser <mreiser@gmail.com>
Date: Thu, 15 Oct 2026 16:41:04 -0400
Subject: [PATCH 1/3] Studio: stop the run when the FicTrac bridge is lost
 mid-run (BRIDGE_LOST, LAB-303 S1)

ww18 2026-10-15 (step 5.7): the bridge was hard-killed 10 s into a closed-loop epoch.
The Studio only showed "bridge disconnected"; the run carried on with no frames.

- fictrac-bridge-client.js: an OPEN socket that closes without disconnect() asking
  is a loss. Fail closed first (apply off, pending index dropped, every pending
  request settled at once via _failPending: log export rejects "bridge lost", level
  ack waiters resolve null), then emit 'lost' {code, apply, logFile, ...}.
  disconnect() clears _ws before close() so a requested close is never a loss; a
  superseded socket closing after a reconnect no longer clobbers the new one.
  New logFile (log_control_ack `file`) and lastLoss getters.
- arena-runner-g6.js: onBridgeLost(info) stops the run when a closed loop was
  applying, when a step acts through the bridge (sequenceUsesBridge), or when the
  run's record lives on it (runSequence {bridgeRequired}); otherwise a test run
  continues with a bridge-lost event. The stop is the ordinary stop() (the serial
  link is fine: real STOP, LED off, loop disarmed); summary.bridgeLost, not a fault.
- arena-session.js: routes 'lost' to the runner, re-emits 'bridgelost'
  {info, action, running}; stale-cache runner fallback = stop().
- run-log.js + studio-runlog-adapter.js: outcome BRIDGE_LOST, bridge-lost transcript line.
- arena_studio.html: persistent #runAlert (role=alert), recorded runs pass
  bridgeRequired, BRIDGE_LOST is not auto-committed, a push refuses a log_export whose
  name is not this run's bridge file (a restarted bridge serves another file), soak
  ends with reason bridge-lost; cache tokens bumped on the changed scripts.

Tests: client 183, runner 529, session 106 (incl. end to end: real client + runner +
session + run log, socket killed mid epoch -> BRIDGE_LOST in < 2 s, pending export
fails fast, STOP sent), run-log 39, adapter 34; suite 60/60; studio-smoke 0 failures.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CLAUDE.md                           |  13 ++
 arena_studio.html                   |  96 ++++++++++--
 js/arena-runner-g6.js               | 124 +++++++++++++++
 js/arena-session.js                 |  36 ++++-
 js/fictrac-bridge-client.js         | 105 +++++++++++--
 js/run-log.js                       |  13 ++
 js/studio-runlog-adapter.js         |  10 +-
 tests/test-arena-runner-g6.js       | 204 +++++++++++++++++++++++++
 tests/test-arena-session.js         | 229 ++++++++++++++++++++++++++++
 tests/test-fictrac-bridge-client.js | 129 +++++++++++++++-
 tests/test-run-log.js               |  10 ++
 tests/test-studio-runlog-adapter.js |  39 +++++
 12 files changed, 981 insertions(+), 27 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 24d2f417..b9225d6b 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -342,6 +342,19 @@ fix flows to every page automatically; two hand-written HTML pages never will.
   `write_rows`, verbatim `["cc"|"cf"|"cs", …]`). The record schema lives in ONE place — the header
   comment of `js/arena-telemetry.js` — mirror any firmware change there + in `wedge-scan.py`
   (`CTL_TAGS`/`CTL_STATE_KINDS`). Never drain while the post-mortem owns the link (its `canPoll`).
+- **Bridge-loss lifecycle (LAB-303 S1, ww18 2026-10-15) — the other fail-closed rule:** an OPEN
+  bridge socket that closes without `disconnect()` asking is a LOSS (`disconnect()` clears `_ws`
+  BEFORE `close()` — that is the discriminator; keep it). `FicTracBridgeClient` then forces apply
+  OFF, calls `_failPending('bridge lost')` (THE one place every request/reply waiter settles —
+  register any NEW request type there, e.g. #254's connector_command waiters) and only then emits
+  `'lost'`. `ArenaSession` → `runner.onBridgeLost(info)`: it STOPS the run when apply was on, when
+  `sequenceUsesBridge` finds a bridge-routed plugin command (today `fictracPluginNames`; add any new
+  bridge-routed plugin set there), or with `runSequence({bridgeRequired})` (the Studio passes it for
+  recorded runs) — via the ordinary `stop()` (serial link is fine → real STOP), never a controller
+  fault (no post-mortem). Otherwise a test run continues with a `bridge-lost` event. Outcome
+  `BRIDGE_LOST` (`summary.bridgeLost`; `run-log.js` + adapter) is NOT auto-committed, and a push
+  refuses a `log_export` whose name ≠ the run's `log.bridgeFile` (a restarted bridge serves another
+  file). Studio: persistent `#runAlert` (`Studio.showRunAlert`), not the auto-hiding `#banner`.
 - **Wire module exports:** `js/arena-wire-g6.js` defines more than it exports —
   when adding encoders/decoders, add them to the export list AND a test; audit
   with `Object.keys(require('./js/arena-wire-g6.js'))` vs the page's `Wire.*`
diff --git a/arena_studio.html b/arena_studio.html
index 0cd898fb..76753923 100644
--- a/arena_studio.html
+++ b/arena_studio.html
@@ -813,6 +813,11 @@
   #ghQuickLinks .ql-link:hover{border-color:var(--accent);background:color-mix(in srgb,var(--accent) 8%,transparent)}
   .banner{background:color-mix(in srgb,var(--warn) 12%,transparent);border:1px solid var(--warn);color:var(--warn);border-radius:8px;padding:8px 12px;margin:10px 20px;font-size:12px;display:none}
   .banner.show{display:block}
+  /* Run alert: a safety event the operator must SEE (bridge lost mid-run) — stays until
+     dismissed or the next run starts, unlike #banner, which later messages replace. */
+  .run-alert{background:color-mix(in srgb,var(--danger) 12%,transparent);border-color:var(--danger);color:var(--danger);font-weight:600;align-items:center;gap:12px}
+  .run-alert.show{display:flex}
+  .run-alert button{margin-left:auto;flex:0 0 auto;background:transparent;border:1px solid currentColor;color:inherit;border-radius:5px;padding:1px 8px;cursor:pointer;font:inherit}
 
   /* ── Edit view: tab bar (Designer | YAML) + YAML pane ───────────── */
   .edit-view .edit-tabs{display:flex;border:1px solid var(--border);border-radius:5px;overflow:hidden;flex:0 0 auto}
@@ -2472,6 +2477,7 @@
 
 <input type="file" id="fileInput" accept=".yaml,.yml" style="display:none" />
 <div class="banner" id="banner"></div>
+<div class="banner run-alert" id="runAlert" role="alert"><span id="runAlertTxt"></span><button type="button" id="runAlertClose" title="Hide this alert (the run log keeps the event)">✕</button></div>
 
 <!-- picker modal (Open from library… / Open from course repo…) -->
 <div class="picker-overlay" id="pickerOverlay" style="display:none">
@@ -2644,7 +2650,7 @@ <h3>Sequence · test any single condition ▶ <span id="docSummary" class="doc-s
             <button class="pill log-only" id="btnLogClear">Clear</button>
             <button class="pill log-only" id="btnLogCopy" title="Copy log to clipboard">Copy</button>
             <button class="pill log-only" id="btnLogSave" title="Download the recorded run log (.json + .txt)" disabled>⬇ Save</button>
-            <button class="pill log-only" id="btnLogPush" title="Push this run's log to the course repo (runlogs/&lt;bench-id&gt;/, gzipped .jsonl.gz) — use after an auto-commit was skipped (aborted/disconnected) or failed. Needs the bridge still connected; it re-serves the last run until the next one." disabled>⇪ Push log</button>
+            <button class="pill log-only" id="btnLogPush" title="Push this run's log to the course repo (runlogs/&lt;bench-id&gt;/, gzipped .jsonl.gz) — use after an auto-commit was skipped (aborted/disconnected) or failed. Needs the bridge still connected; it re-serves the last run until the next one. A restarted bridge serves a different file, so the push refuses it." disabled>⇪ Push log</button>
           </span>
           <!-- Scope controls live ON the header row in scope mode (maximizes the
                canvas); hidden in log mode. The .acts group is hidden in scope mode. -->
@@ -3363,10 +3369,10 @@ <h2 id="modalTitle">Import error</h2>
 <script src="js/studio-analog-in.js"></script>
 <script src="js/studio-panel-inventory.js"></script>
 <script src="js/arena-link.js"></script>
-<script src="js/arena-runner-g6.js?v=20260926-cl-start"></script> <!-- ?v= forces a fresh load: a cached runner/client silently runs the old closed-loop start -->
-<script src="js/run-log.js"></script>
-<script src="js/fictrac-bridge-client.js?v=20260926-cl-start"></script>
-<script src="js/arena-session.js"></script>
+<script src="js/arena-runner-g6.js?v=20261015-bridge-lost"></script> <!-- ?v= forces a fresh load: a cached runner/client/session silently keeps the old behavior (closed-loop start, bridge-loss stop) -->
+<script src="js/run-log.js?v=20261015-bridge-lost"></script>
+<script src="js/fictrac-bridge-client.js?v=20261015-bridge-lost"></script>
+<script src="js/arena-session.js?v=20261015-bridge-lost"></script>
 <script src="js/pat-encoder.js"></script>
 <script src="js/pattern-set.js"></script>
 <script src="js/pat-preview.js"></script>
@@ -3385,7 +3391,7 @@ <h2 id="modalTitle">Import error</h2>
 </script>
 <script src="js/studio-meta.js"></script>
 <script src="js/studio-url-state.js?v=20260924-replay"></script>
-<script src="js/studio-runlog-adapter.js"></script>
+<script src="js/studio-runlog-adapter.js?v=20261015-bridge-lost"></script>
 <script src="js/studio-postmortem.js"></script>
 <script src="js/arena-telemetry.js"></script>
 <script src="js/trial-quality.js"></script>
@@ -3613,7 +3619,7 @@ <h2 id="modalTitle">Import error</h2>
     function renderRunEvent(ev) {
         if (!$('runlogBox') || !ev) return;
         const div = document.createElement('div');
-        if (ev.phase === 'error') div.className = 'l-err';
+        if (ev.phase === 'error' || ev.phase === 'bridge-lost') div.className = 'l-err';
         else if (ev.phase === 'skip' || ev.phase === 'warn') div.className = 'l-warn';
         // Reuse run-log.js's own transcript line if available, else a compact fallback.
         div.textContent =
@@ -3661,7 +3667,7 @@ <h2 id="modalTitle">Import error</h2>
             // broker has already aborted the runner (bench 2026-09-13, forced watchdog reset: the
             // terminal event arrived with fault null). The link being down at the terminal event
             // of an abort nobody requested is the same evidence — use either.
-            if (sm && !sm.fault && sm.aborted && !Studio._userStopRequested && (Studio._linkDropped || !(Studio.session && Studio.session.connected))) {
+            if (sm && !sm.fault && !sm.bridgeLost && sm.aborted && !Studio._userStopRequested && (Studio._linkDropped || !(Studio.session && Studio.session.connected))) {
                 sm.fault = 'link_dropped';
                 sm.faultDetail = { kind: 'link_dropped', note: 'controller re-enumerated mid-run (watchdog self-reset?)' };
             }
@@ -3855,6 +3861,12 @@ <h2 id="modalTitle">Import error</h2>
             rawLine('run log NOT auto-committed (' + outcome + ') — click "⇪ Push log" to commit it anyway', 'warn');
             return;
         }
+        if (outcome === 'BRIDGE_LOST') {
+            // The bridge that wrote this run's file is gone; it cannot be exported from here.
+            rawLine('run log NOT auto-committed (BRIDGE_LOST) — the bridge’s file ' +
+                (log.bridgeFile || 'arena-log-*.jsonl') + ' stays on the bridge PC; ⬇ Save keeps this browser’s record', 'warn');
+            return;
+        }
         await commitRunLog(log, {});
     }
     // SHA-256 hex of a byte buffer (SubtleCrypto; secure-context only — the course
@@ -3928,9 +3940,12 @@ <h2 id="modalTitle">Import error</h2>
             return;
         }
         const bridge = Studio.session && Studio.session.bridge;
+        const lostRun = !!(log.summary && log.summary.outcome === 'BRIDGE_LOST');
         if (!bridge || !bridge.connected) {
             showUploadModal('Run log not committed', { error: true,
-                msg: 'Bridge disconnected — the log file remains on the bridge machine. Reconnect the bridge (it re-serves the last run) and push again, or commit it from a local clone.' });
+                msg: lostRun
+                    ? 'This run lost its bridge. Its log file (' + (log.bridgeFile || 'arena-log-*.jsonl') + ') stays on the bridge PC — a restarted bridge cannot serve it. Commit it from there; ⬇ Save keeps this browser’s record.'
+                    : 'Bridge disconnected — the log file remains on the bridge machine. Reconnect the bridge (it re-serves the last run) and push again, or commit it from a local clone.' });
             return;
         }
         let exported;
@@ -3943,6 +3958,19 @@ <h2 id="modalTitle">Import error</h2>
             showUploadModal('Run-log export failed', { error: true, msg: m + '\n\nThe log stays on the bridge machine — nothing lost.' });
             return;
         }
+        // log_export serves the bridge's current-or-most-recent file. After a bridge loss
+        // and restart that is a DIFFERENT file — never commit it under this run's name.
+        const runFile = log.bridgeFile || null;
+        if ((runFile && exported.name && exported.name !== runFile) || (lostRun && !runFile)) {
+            const m = runFile
+                ? 'The bridge served ' + exported.name + ', not this run’s log ' + runFile +
+                  ' (the bridge was restarted or logged something else since).'
+                : 'This run lost its bridge, and the bridge did not name the run’s log file, so the file it serves now cannot be matched to this run.';
+            rawLine('run log NOT committed — ' + m, 'err');
+            showUploadModal('Run log not committed', { error: true,
+                msg: m + '\n\nThis run’s file is on the bridge PC (' + (runFile || 'arena-log-*.jsonl') + ') — commit it from there. ⬇ Save keeps this browser’s record.' });
+            return;
+        }
         const stamp = new Date().toISOString().slice(0, 19).replace(/:/g, '-');
         const proto = GH.slug(String(log.meta.protocol_filename || 'protocol').replace(/\.ya?ml$/i, ''));
         const who = GH.slug(log.meta.experimenter || 'unknown');
@@ -4357,6 +4385,21 @@ <h2 id="modalTitle">Import error</h2>
         setTimeout(() => b.classList.remove('show'), 8000);
     }
     Studio.showBanner = showBanner;
+    // Persistent alert for safety events (#runAlert): no auto-hide, not replaced by
+    // routine banners. Cleared by its ✕ or when the next run starts.
+    function showRunAlert(msg) {
+        const a = $('runAlert');
+        if (!a) { showBanner(msg); return; }
+        $('runAlertTxt').textContent = msg;
+        a.classList.add('show');
+    }
+    function hideRunAlert() {
+        const a = $('runAlert');
+        if (a) a.classList.remove('show');
+    }
+    Studio.showRunAlert = showRunAlert;
+    Studio.hideRunAlert = hideRunAlert;
+    if ($('runAlertClose')) $('runAlertClose').addEventListener('click', hideRunAlert);
 
     // ---- Safe mode (default student mode) -------------------------------------
     // Safe mode is the DEFAULT: a plain load locks Edit, Console, the session-rig
@@ -5748,6 +5791,28 @@ <h2 id="modalTitle">Import error</h2>
                 (d.lastError ? ' (' + d.lastError + ')' : ''), 'err');
             showBanner('⚠ Controller stopped answering — run aborted. Post-mortem probes follow (see the run log).');
         });
+        // FicTrac bridge lost (LAB-303 S1): the socket dropped without a Disconnect.
+        // The broker has already stopped the run when it needed the bridge (closed loop,
+        // a FicTrac step, or a recorded run's log) — say so where nobody can miss it.
+        Studio.session.on('bridgelost', (e) => {
+            const info = (e && e.info) || {};
+            const action = e && e.action;
+            const why = info.apply ? 'the closed loop was running' : 'the bridge connection dropped';
+            const restart = ' Restart the bridge (`pixi run bridge`) before the next run.';
+            let msg = null;
+            if (action === 'aborted') {
+                msg = '⚠ FicTrac bridge lost mid-run (' + why + ') — the run was STOPPED (outcome BRIDGE_LOST). ' +
+                    'The display was stopped and the closed loop is off. The bridge’s log of this run ends at the loss; ' +
+                    '⬇ Save keeps this browser’s record.' + restart;
+            } else if (action === 'continued') {
+                msg = '⚠ FicTrac bridge lost — this test run continues, but nothing after this point is in the bridge log.' + restart;
+            } else if (info.apply) {
+                msg = '⚠ FicTrac bridge lost — the closed loop stopped (the arena no longer follows the ball).' + restart;
+            }
+            rawLine('⚠ bridge lost' + (info.code != null ? ' (code ' + info.code + ')' : '') +
+                (action ? ' — run ' + (action === 'aborted' ? 'stopped' : action) : ''), 'err');
+            if (msg) showRunAlert(msg);
+        });
         Studio.session.on('disconnect', (info) => {
             if (info && info.involuntary) Studio._linkDropped = true; // consumed by runSteps (fault lifecycle)
             if (info && info.involuntary && Studio.activeRunLog && !Studio.activeRunLog.summary) {
@@ -9380,7 +9445,7 @@ <h2 id="modalTitle">Import error</h2>
                 // Open loop: the controller steps the pattern itself (no 0x70s) — exposure is
                 // in the telemetry FRAME rows, judged by telemetry-report.py, not here.
                 const exercised = !closedLoop || applied >= Math.min(1000, 5 * durS); // ≥ 5 Hz average, or 1000 total
-                let outcome = !res ? 'not-started' : res.fault ? 'fault' : res.aborted ? 'aborted' : exercised ? 'completed' : 'unexercised';
+                let outcome = !res ? 'not-started' : res.fault ? 'fault' : res.bridgeLost ? 'bridge-lost' : res.aborted ? 'aborted' : exercised ? 'completed' : 'unexercised';
                 logSoak({
                     phase: 'iteration-end', iteration: s.iteration,
                     outcome,
@@ -9400,7 +9465,8 @@ <h2 id="modalTitle">Import error</h2>
                     if (!pmo || (pmo.outcome !== 'recovered' && pmo.outcome !== 'self-reset')) { reason = pmo ? 'fault-' + pmo.outcome : 'fault'; break; }
                     s.resets++;
                     Studio.rawLog('soak: controller recovered (reset ' + s.resets + '/' + s.maxResets + ') — continuing', 'warn');
-                } else if (res.aborted) { reason = 'operator-stop'; break; }
+                } else if (res.bridgeLost) { reason = 'bridge-lost'; break; }
+                else if (res.aborted) { reason = 'operator-stop'; break; }
                 if (s.stop) { reason = s.stopReason || 'operator'; break; }
                 // Gap + input freshness re-check (a dead simulator is a harness
                 // problem, not a controller fault — pause, don't count it).
@@ -9797,6 +9863,9 @@ <h2 id="modalTitle">Import error</h2>
         const ackLevel = bridge.connected && bridge.waitForLogLevelAck ? await bridge.waitForLogLevelAck(800) : null;
         const logLevel = ackLevel || (wantLevel === 'behavior_v2' ? 'behavior_v1' : wantLevel);
         Studio._runLogFormat = bridge.connected ? logLevel : null;
+        // The file the bridge opened for THIS run (log_control_ack). A later push checks
+        // that log_export serves it — a bridge restarted after a loss serves another file.
+        if (Studio.activeRunLog) Studio.activeRunLog.bridgeFile = (bridge.connected && bridge.logFile) || null;
         const levelNote = !bridge.connected ? ''
             : ackLevel === wantLevel ? ' (' + ackLevel + ')'
             : ackLevel ? ' ⚠ bridge too old for ' + wantLevel + ' — logging ' + ackLevel + ' (restart `pixi run bridge` from the current checkout)'
@@ -9853,6 +9922,7 @@ <h2 id="modalTitle">Import error</h2>
     let summary = null;
     Studio._userStopRequested = false;
     Studio._linkDropped = false;
+    if (Studio.hideRunAlert) Studio.hideRunAlert(); // a new run starts with no stale bridge-lost alert
     if (Studio.trialQuality) Studio.trialQuality.reset(); // per-trial stimulus-quality verdicts start fresh
     Studio._tqFinal = null; // finalizeTrialQuality() runs once per run (first caller wins, others await it)
     // Bind the verdict to THIS run: a late terminal event from a previous (aborted) run must not finalize
@@ -9872,6 +9942,9 @@ <h2 id="modalTitle">Import error</h2>
                 ? Studio.resolveRuntimeCondition
                 : undefined,
             fictracPluginNames: new Set(ftNames),
+            // A recorded run's record IS the bridge log (the run is gated on the bridge),
+            // so losing the bridge stops it — not only when a FicTrac step needs it.
+            bridgeRequired: !!isExperiment && !!(bridge && bridge.connected),
             degPerFrame: Studio.rigDegPerFrame(),
             defaultCoupling: Studio._legacyDefaultCoupling == null ? 1 : Studio._legacyDefaultCoupling
         });
@@ -17175,6 +17248,7 @@ <h2 id="modalTitle">Import error</h2>
     '#btnAllOff': 'Turn every LED off.',
     '#btnLogSave': 'Download the run log as files (.json and .txt).',
     '#btnLogPush': 'Send the last run’s log to the course repo — use this if the automatic push was skipped or failed.',
+    '#runAlert': 'Something stopped your run or the closed loop (for example, the FicTrac bridge closed). The message says what happened and what to do; the run log keeps it too. ✕ hides it.',
     '#btnLogClear': 'Clear the log display (saved logs are not deleted).',
     '#btnLogCopy': 'Copy the log text to the clipboard.',
     '.seqlist': 'The experiment’s sequence. Each row is a condition — ▶ on a row tests just that one on the arena.',
diff --git a/js/arena-runner-g6.js b/js/arena-runner-g6.js
index 94fa7f61..ca4d8f5b 100644
--- a/js/arena-runner-g6.js
+++ b/js/arena-runner-g6.js
@@ -714,6 +714,47 @@ var ArenaRunnerG6 = (function () {
         return out;
     }
 
+    // JSON-safe copy of a bridge 'lost' info for the run record (the summary and the
+    // bridge-lost event both serialize into the run log).
+    function lostDetail(info) {
+        const out = { kind: 'bridge_lost' };
+        if (!info || typeof info !== 'object') return out;
+        for (const k of ['code', 'reason', 'wasClean', 'apply', 'logFile', 'url', 't']) {
+            const v = info[k];
+            if (v !== undefined && v !== null && v !== '' && typeof v !== 'object') out[k] = v;
+        }
+        return out;
+    }
+
+    /**
+     * Does any condition this sequence runs carry a plugin command that acts through
+     * the bridge (FicTrac today)? Losing the bridge mid-run makes every later such
+     * step run blind, so ArenaRunner.onBridgeLost stops a run for which this is true.
+     * Scans the authored command lists (runtime controls change parameters, never
+     * plugin names), each condition once.
+     * @param {Array} steps
+     * @param {Map} conditionsByName
+     * @param {Set<string>|null} bridgePluginNames  plugin instance names routed via the bridge
+     * @returns {boolean}
+     */
+    function sequenceUsesBridge(steps, conditionsByName, bridgePluginNames) {
+        if (!bridgePluginNames || typeof bridgePluginNames.has !== 'function') return false;
+        if (!bridgePluginNames.size) return false;
+        const seen = new Set();
+        for (const step of Array.isArray(steps) ? steps : []) {
+            const name = step && step.conditionName;
+            if (seen.has(name)) continue;
+            seen.add(name);
+            const cond = conditionsByName && conditionsByName.get(name);
+            if (!cond || !Array.isArray(cond.commands)) continue;
+            for (const cmd of cond.commands) {
+                if (cmd && cmd.type === 'plugin' && bridgePluginNames.has(cmd.plugin_name))
+                    return true;
+            }
+        }
+        return false;
+    }
+
     /**
      * Translate ONE v3 command into a wire-neutral instruction descriptor (the
      * "command IR"). PURE and wire-free so it is trivially unit-testable; the
@@ -1104,6 +1145,9 @@ var ArenaRunnerG6 = (function () {
             this._emit = null; // current run's status emit (for async LED events)
             this._faultReason = null; // set by fault() / a timed-out wire command
             this._faultDetail = null;
+            this._bridgeLost = null; // set by bridgeLost(): the bridge's 'lost' info
+            this._bridgeRequired = false; // this run's record lives on the bridge (recorded runs)
+            this._bridgeDependent = false; // this run has steps that act through the bridge
         }
 
         get active() {
@@ -1140,6 +1184,9 @@ var ArenaRunnerG6 = (function () {
 
             this._active = true;
             this._conditionName = a.conditionName || null;
+            this._bridgeLost = null;
+            this._bridgeRequired = false; // a single trial depends on the bridge only via apply
+            this._bridgeDependent = false;
 
             let frame;
             try {
@@ -1247,6 +1294,72 @@ var ArenaRunnerG6 = (function () {
             return this._faultReason;
         }
 
+        /**
+         * The bridge WebSocket dropped (FicTracBridgeClient 'lost' — ArenaSession calls
+         * this). Decides what the active run does:
+         *   - 'aborted'   the run needs the bridge — a closed loop was applying, a later
+         *                 step acts through the bridge (a FicTrac plugin), or the run's
+         *                 record lives on it (`bridgeRequired`, recorded runs) → bridgeLost()
+         *   - 'continued' a test run that needs nothing from the bridge: it keeps going,
+         *                 with a 'bridge-lost' event so the transcript says logging stopped
+         *   - 'idle'      no run is active
+         * @param {object} [info] the client's 'lost' info ({code, apply, logFile, …})
+         * @returns {'aborted'|'continued'|'idle'}
+         */
+        onBridgeLost(info) {
+            if (!this._active) return 'idle';
+            const apply = !!(info && info.apply);
+            if (apply || this._bridgeDependent || this._bridgeRequired) {
+                this.bridgeLost(info);
+                return 'aborted';
+            }
+            if (this._emit) {
+                try {
+                    this._emit({
+                        phase: 'bridge-lost',
+                        reason: 'bridge_lost',
+                        action: 'continued',
+                        detail: lostDetail(info)
+                    });
+                } catch (_) {
+                    /* a status sink must not break the caller */
+                }
+            }
+            return 'continued';
+        }
+
+        /**
+         * End the active run because the bridge is gone. Records the loss (the terminal
+         * summary carries `bridgeLost`, which the run log turns into the BRIDGE_LOST
+         * outcome — never ABORTED_BY_USER, never a controller fault), emits a
+         * `bridge-lost` status event, then takes the ordinary stop() path: the serial
+         * link is healthy, so the display gets a real STOP, the LED goes off and the
+         * closed loop is disarmed, exactly as for an operator STOP.
+         * @param {object} [info] the client's 'lost' info
+         * @returns {Promise} the stop() result (never rejects)
+         */
+        bridgeLost(info) {
+            this._bridgeLost = lostDetail(info);
+            if (this._emit) {
+                try {
+                    this._emit({
+                        phase: 'bridge-lost',
+                        reason: 'bridge_lost',
+                        action: 'stopped',
+                        detail: this._bridgeLost
+                    });
+                } catch (_) {
+                    /* a status sink must not break the stop */
+                }
+            }
+            return this.stop().catch(() => null);
+        }
+
+        /** The bridge-loss record of the current/last run, or null. */
+        get bridgeLostInfo() {
+            return this._bridgeLost;
+        }
+
         /** Clear run-state without sending STOP (used on disconnect/error). Also
          *  aborts a running sequence and unblocks its current wait. */
         _clear() {
@@ -1533,6 +1646,9 @@ var ArenaRunnerG6 = (function () {
          *        a non-mutating condition copy around those commands.  The hook
          *        runs after step-start and before any command translation/send.
          * @param {Set|Array} [a.fictracPluginNames]  plugin names whose class is FicTracPlugin
+         * @param {boolean}  [a.bridgeRequired]  the run's record lives on the bridge (a
+         *                                        recorded run): losing the bridge stops it even
+         *                                        when no step acts through the bridge
          * @param {function} [a.onProgress]      progress/event callback (see phases below)
          * @param {function} [a.timing]          async (durationSec, sleep) ⇒ trial end
          *                                        (defaults to host-side; firmware #4 swap)
@@ -1586,6 +1702,10 @@ var ArenaRunnerG6 = (function () {
             this._frameCountCache = new Map();
             this._faultReason = null;
             this._faultDetail = null;
+            this._bridgeLost = null;
+            this._bridgeRequired = !!a.bridgeRequired;
+            this._bridgeDependent =
+                !!this._bridge && sequenceUsesBridge(steps, conditionsByName, fictracPluginNames);
             this._oldBridgeStartWarned = false; // one "bridge ignores the start frame" warning per run
             // A stale closed-loop apply (left on by Console use or an aborted run)
             // would push FicTrac frames into the opening Mode-2 step — the firmware
@@ -1816,6 +1936,9 @@ var ArenaRunnerG6 = (function () {
                 // the controller stopped answering (fault() / a timed-out command).
                 summary.fault = this._faultReason || null;
                 if (this._faultDetail) summary.faultDetail = this._faultDetail;
+                // The bridge dropped and the run stopped for it (BRIDGE_LOST outcome).
+                // A continued test run records only its bridge-lost event, not this.
+                if (this._bridgeLost) summary.bridgeLost = this._bridgeLost;
                 // The terminal event is emitted from `finally`, AFTER the best-effort
                 // STOP, so the serialized summary (run log, auto-commit trigger)
                 // carries `stopAcked` — review finding: it used to be present only
@@ -2134,6 +2257,7 @@ var ArenaRunnerG6 = (function () {
         conditionCommandCount,
         flattenStructure,
         translateCommand,
+        sequenceUsesBridge, // does a run have steps that act through the bridge? (bridge-loss policy)
         hostSideTrialEnd,
         RUNNABLE_CONTROLLER_COMMANDS,
         LED_OFF_MV, // BuckPuck "LED dark" analog level (mV) — the scope's on/off threshold
diff --git a/js/arena-session.js b/js/arena-session.js
index e20ad252..231abe2a 100644
--- a/js/arena-session.js
+++ b/js/arena-session.js
@@ -30,6 +30,13 @@
  *   'disconnect' ({ involuntary:boolean })      — port closed (cable-pull = true, user Disconnect = false)
  *   'state'      ()                             — connection/run state changed; re-evaluate UI gating
  *   'runstatus'  (s:object)                     — runner status/progress phase (single-trial AND sequence)
+ *   'fault'      (f:object)                     — closed-loop controller fault (fw #50); the run is aborting
+ *   'bridgelost' ({info, action, running})      — the FicTrac bridge socket dropped without being
+ *                                                 asked to. action: 'aborted' (the run is stopping,
+ *                                                 outcome BRIDGE_LOST) | 'continued' (a test run that
+ *                                                 needs nothing from the bridge) | 'idle' (no run).
+ *                                                 info = the client's 'lost' info (info.apply: a
+ *                                                 closed loop was running, e.g. the Console's)
  *
  * SEND / STOP SEMANTICS: ArenaLink.send is single-flight + echo-correlated +
  * FIFO-queued (arena-link.js). STOP therefore QUEUES behind any in-flight send
@@ -49,7 +56,7 @@
             ? () => performance.now()
             : () => Date.now();
 
-    const EVENTS = ['log', 'error', 'disconnect', 'state', 'runstatus', 'fault'];
+    const EVENTS = ['log', 'error', 'disconnect', 'state', 'runstatus', 'fault', 'bridgelost'];
 
     class ArenaSession {
         /**
@@ -160,9 +167,29 @@
                     this._emit('fault', f);
                     this._emit('state');
                 });
+                // Bridge lost mid-run (LAB-303 S1, ww18 2026-10-15): the socket dropped
+                // without disconnect() asking. The client has already forced apply off
+                // and failed every pending request; the RUNNER decides whether the run
+                // stops (it needs the bridge) or continues, and the page banners it.
+                this._bridge.on('lost', (info) => this._onBridgeLost(info));
             }
         }
 
+        _onBridgeLost(info) {
+            const running = !!this._runner.active;
+            let action = running ? 'continued' : 'idle';
+            if (typeof this._runner.onBridgeLost === 'function') {
+                action = this._runner.onBridgeLost(info);
+            } else if (running && !this.outputInhibited) {
+                // Stale-cache runner without onBridgeLost: stop the run the ordinary way
+                // (the serial link is fine) rather than let it run on blind.
+                this._runner.stop().catch(() => {});
+                action = 'aborted';
+            }
+            this._emit('bridgelost', { info: info || null, action, running });
+            this._emit('state');
+        }
+
         /** Web Serial available? (Chromium-desktop only.) Gate every connect UI on this. */
         static isSupported() {
             const LinkClass = typeof window !== 'undefined' ? window.ArenaLink : undefined;
@@ -475,6 +502,8 @@
          * @param {Function} [a.resolveCondition] optional async trial-boundary resolver;
          *        forwarded verbatim to ArenaRunner.runSequence
          * @param {Function} [a.onProgress]       per-call progress sink (also broadcast as 'runstatus')
+         * @param {boolean}  [a.bridgeRequired]   the run's record lives on the bridge (recorded runs):
+         *        a bridge loss stops it even with no FicTrac step (see ArenaRunner.onBridgeLost)
          * @param {Function} [a.timing]           host-timing fn (default runner's hostSideTrialEnd — FW#4 swap point)
          * @param {Function} [a.sleep]            sleep(ms) (default runner's abort-aware sleep; tests inject instant)
          * @returns {Promise<{completed,aborted,steps,errors,skipped}>}
@@ -490,6 +519,7 @@
                 resolvePatternFrames: args.resolvePatternFrames,
                 resolveCondition: args.resolveCondition,
                 fictracPluginNames: args.fictracPluginNames,
+                bridgeRequired: args.bridgeRequired, // recorded runs: losing the bridge stops the run
                 timing: args.timing,
                 sleep: args.sleep,
                 onProgress: (s) => this._onRunStatus(s, args.onProgress)
@@ -540,7 +570,8 @@
                 'on',
                 'ledPercent',
                 'mv', // v0.86 graded zones: the commanded AO voltage per level step
-                'ledActivation'
+                'ledActivation',
+                'action' // bridge-lost: 'stopped' | 'continued'
             ];
             for (const k of keys) if (s[k] !== undefined) out[k] = s[k];
             if (s.params && typeof s.params === 'object') out.params = s.params;
@@ -573,6 +604,7 @@
                     'skipped',
                     'fault',
                     'faultDetail',
+                    'bridgeLost',
                     'stopAcked'
                 ]) {
                     if (s.summary[k] !== undefined) sm[k] = s.summary[k];
diff --git a/js/fictrac-bridge-client.js b/js/fictrac-bridge-client.js
index 6a4cada2..af5de421 100644
--- a/js/fictrac-bridge-client.js
+++ b/js/fictrac-bridge-client.js
@@ -58,6 +58,16 @@
  *                                            ok=false ⇒ the bridge cannot write the
  *                                            requested level (too old) and `level`
  *                                            is what it logs instead.
+ *   'fault'   (fault:object)               — the closed-loop apply loop latched a
+ *                                            controller fault (fw #50)
+ *   'lost'    (info:object)                — an OPEN bridge socket closed without
+ *                                            disconnect() asking for it (bridge killed
+ *                                            or crashed). Fail closed BEFORE this fires:
+ *                                            apply is already OFF and every pending
+ *                                            request already settled. info = {url, code,
+ *                                            reason, wasClean, apply (was it on), logging,
+ *                                            logFile, recv, t}. ArenaSession routes it to
+ *                                            the runner (ArenaRunner.onBridgeLost).
  */
 (function (global) {
     'use strict';
@@ -73,7 +83,8 @@
         'bias',
         'log',
         'loglevel',
-        'fault'
+        'fault',
+        'lost'
     ];
     // Log levels this client knows how to request, most-preferred first. The
     // bridge advertises ITS list in hello_ack; a level missing there is one the
@@ -169,7 +180,9 @@
             this._stale = 0;
             this._bridgeInfo = null; // from hello_ack: {version, levels, level} (null = old bridge / not yet)
             this._ackedLevel = null; // from log_control_ack while logging is enabled
+            this._logFile = null; // basename of the log file the bridge opened (log_control_ack)
             this._ackWaiters = []; // waitForLogLevelAck() resolvers
+            this._lastLoss = null; // the most recent 'lost' info (null = never lost)
         }
 
         // ---- events ----------------------------------------------------------
@@ -298,8 +311,10 @@
             this._recv = 0;
             this._applied = 0;
             this._pending = null;
+            let opened = false; // a socket that never opened was a failed connect, not a loss
             this._emit('status', 'connecting…', 'dim');
             ws.onopen = () => {
+                opened = true;
                 this._emit('status', 'connected', 'accent');
                 this._emit('log', 'bridge: connected to ' + this._url, 'info');
                 this._send({ type: 'hello', client: 'webDisplayTools', v: 1 });
@@ -326,31 +341,92 @@
                 else if (msg && msg.type === 'log_control_ack') this._handleLogControlAck(msg);
             };
             ws.onerror = () => this._emit('status', 'error', 'err');
-            ws.onclose = () => {
+            ws.onclose = (ev) => {
+                // A superseded socket closing after a reconnect must not tear down the
+                // new one's state.
+                if (this._ws !== ws && this._ws !== null) return;
+                // disconnect() clears _ws BEFORE closing, so a close that finds this
+                // socket still current was not asked for: the bridge went away.
+                const lost = opened && this._ws === ws;
+                const wasApply = this._apply;
                 this._stopRateTimer();
                 this._ws = null;
+                if (lost) {
+                    // Fail closed first: nothing may keep "driving" from a dead feed.
+                    this._pending = null;
+                    if (this._apply) {
+                        this._apply = false;
+                        this._emit('apply', false);
+                    }
+                }
+                const logFile = this._logFile;
                 this._bridgeInfo = null;
                 this._ackedLevel = null;
-                this._settleAckWaiters(null);
-                this._settleExport('reject', new Error('bridge disconnected during log export'));
-                this._emit('status', 'disconnected', 'dim');
+                this._logFile = null;
+                this._failPending(lost ? 'bridge lost' : 'bridge disconnected');
+                this._emit('status', lost ? 'disconnected (bridge lost)' : 'disconnected', 'dim');
                 this._emit('stats', this.stats);
+                if (lost) {
+                    this._lastLoss = {
+                        url: this._url || null,
+                        code: ev && Number.isFinite(ev.code) ? ev.code : null,
+                        reason: (ev && ev.reason) || '',
+                        wasClean: !!(ev && ev.wasClean),
+                        apply: wasApply,
+                        logging: this._logging,
+                        logFile,
+                        recv: this._recv,
+                        t: this._now()
+                    };
+                    this._emit(
+                        'log',
+                        'bridge lost (' +
+                            (this._lastLoss.code != null
+                                ? 'code ' + this._lastLoss.code
+                                : 'socket closed') +
+                            (wasApply ? ', closed loop was running' : '') +
+                            ')',
+                        'err'
+                    );
+                    this._emit('lost', Object.assign({}, this._lastLoss));
+                }
             };
         }
 
-        /** Close the bridge WebSocket (idempotent). */
+        /** Close the bridge WebSocket (idempotent). A close asked for here is never 'lost'. */
         disconnect() {
-            if (this._ws) {
+            const ws = this._ws;
+            this._ws = null; // first: onclose may run synchronously, and must see a requested close
+            if (ws) {
                 try {
-                    this._ws.close();
+                    ws.close();
                 } catch (_) {
                     /* closing socket can throw — ignore */
                 }
             }
-            this._ws = null;
             this._stopRateTimer();
         }
 
+        /** The most recent unexpected loss ('lost' info), or null if the bridge never dropped. */
+        get lastLoss() {
+            return this._lastLoss ? Object.assign({}, this._lastLoss) : null;
+        }
+
+        // Settle every request still waiting on the bridge, NOW — a dead socket will
+        // never answer, and a caller must not sit out its timeout (log export 15 s).
+        // The one place a new request/reply pair registers its fail-fast path.
+        _failPending(reason) {
+            this._settleAckWaiters(null);
+            this._settleExport(
+                'reject',
+                new Error(
+                    reason === 'bridge lost'
+                        ? 'bridge lost — the connection dropped during log export'
+                        : 'bridge disconnected during log export'
+                )
+            );
+        }
+
         // ---- config / logging ------------------------------------------------
         /**
          * Merge config (any subset of fictrac_port/gain/offset/frames/bias) and push if
@@ -558,6 +634,15 @@
         get ackedLogLevel() {
             return this._ackedLevel;
         }
+        /**
+         * Basename of the log file the bridge opened for the current logging session
+         * (log_control_ack `file`), or null: not acked yet, logging off, disconnected,
+         * or a bridge too old to name it. A run stashes it so a later push can check
+         * that log_export serves THIS run's file, not one a restarted bridge opened.
+         */
+        get logFile() {
+            return this._logFile;
+        }
         /** hello_ack facts {version, levels, level} — null until a ≥3.0 bridge answers. */
         get bridgeInfo() {
             return this._bridgeInfo;
@@ -632,6 +717,7 @@
             const level = msg.level || null;
             const enabled = !!msg.enabled;
             this._ackedLevel = enabled ? level : null;
+            this._logFile = enabled && typeof msg.file === 'string' ? msg.file : null;
             const ok = !enabled || level === requested;
             if (!ok) {
                 this._emit(
@@ -660,6 +746,7 @@
         setLogging(on) {
             this._logging = !!on;
             this._ackedLevel = null; // pending until the bridge acks this request
+            this._logFile = null; // the ack names the file this request opens
             const msg = { type: 'log_control', enabled: this._logging };
             if (this._logging) msg.level = this._config.logLevel;
             this._send(msg);
diff --git a/js/run-log.js b/js/run-log.js
index f85f3916..f5a3ddf6 100644
--- a/js/run-log.js
+++ b/js/run-log.js
@@ -50,6 +50,7 @@
         if (override) return override;
         if (!summary) return 'UNKNOWN';
         if (summary.fault) return 'CONTROLLER_FAULT'; // controller stopped answering (fw #50)
+        if (summary.bridgeLost) return 'BRIDGE_LOST'; // the bridge dropped; the run stopped for it
         if (summary.aborted) return 'ABORTED_BY_USER';
         if (summary.errors > 0) return 'ERRORED';
         if (summary.completed) return 'COMPLETED';
@@ -155,6 +156,18 @@
                     (ev.reason || 'controller_unresponsive') +
                     (ev.detail && ev.detail.lastError ? ' — ' + ev.detail.lastError : '')
                 );
+            case 'bridge-lost': {
+                const d = ev.detail || {};
+                return (
+                    stamp +
+                    '⚠ BRIDGE LOST' +
+                    (d.code != null ? ' (code ' + d.code + ')' : '') +
+                    (d.apply ? ' — closed loop was running' : '') +
+                    (ev.action === 'continued'
+                        ? ' — test run continues, no longer logged by the bridge'
+                        : ' — run stopped')
+                );
+            }
             case 'step-done':
                 return stamp + '   ' + where + 'done';
             case 'sequence-complete':
diff --git a/js/studio-runlog-adapter.js b/js/studio-runlog-adapter.js
index a90d2fb4..c4fe5560 100644
--- a/js/studio-runlog-adapter.js
+++ b/js/studio-runlog-adapter.js
@@ -29,6 +29,7 @@
         skip: 1,
         error: 1,
         fault: 1, // controller stopped answering (fw #50) — precedes a terminal `aborted`
+        'bridge-lost': 1, // the bridge dropped mid-run (stopped → a terminal `aborted` follows)
         'step-done': 1,
         'sequence-complete': 1,
         aborted: 1
@@ -60,12 +61,15 @@
         if (isTerminal(phase)) {
             // An `aborted` whose summary carries a fault reason is the CONTROLLER
             // giving up, not the operator — label it so (it also auto-commits).
-            const faulted = phase === 'aborted' && s.summary && s.summary.fault;
+            // One carrying `bridgeLost` stopped because the bridge went away.
+            const sm = s.summary || {};
             const override =
                 phase === 'aborted'
-                    ? faulted
+                    ? sm.fault
                         ? 'CONTROLLER_FAULT'
-                        : 'ABORTED_BY_USER'
+                        : sm.bridgeLost
+                          ? 'BRIDGE_LOST'
+                          : 'ABORTED_BY_USER'
                     : undefined;
             const summary = log.finish(s.summary || null, override);
             return { event: ev, terminal: true, summary: summary };
diff --git a/tests/test-arena-runner-g6.js b/tests/test-arena-runner-g6.js
index aff5b345..48e0dd5f 100644
--- a/tests/test-arena-runner-g6.js
+++ b/tests/test-arena-runner-g6.js
@@ -17,6 +17,7 @@
 
 const Runner = require('../js/arena-runner-g6.js');
 const Wire = require('../js/arena-wire-g6.js');
+const RunLog = require('../js/run-log.js');
 
 let totalChecks = 0;
 let failures = 0;
@@ -2938,6 +2939,209 @@ async function main() {
         check('clean run → stopAcked true', s4.stopAcked, true);
     }
 
+    // ── LAB-303 S1 (ww18, 2026-10-15): bridge hard-killed 10 s into a closed-loop
+    // epoch; the run carried on with no frames. Now the runner stops it (BRIDGE_LOST).
+    {
+        const lostBridge = () => ({
+            logging: true,
+            apply: false,
+            bias: null,
+            configs: [],
+            applyStates: [],
+            connect() {},
+            disconnect() {},
+            setApply(on) {
+                this.apply = !!on;
+                this.applyStates.push(!!on);
+            },
+            setConfig(cfg) {
+                this.configs.push(cfg);
+            },
+            log() {}
+        });
+        const clCond = {
+            name: 'cl',
+            commands: [
+                {
+                    type: 'controller',
+                    command_name: 'trialParams',
+                    mode: 3,
+                    frame_rate: 0,
+                    gain: 0,
+                    frame_index: 0,
+                    duration: 30,
+                    pattern: 'p'
+                },
+                { type: 'plugin', plugin_name: 'fictrac', command_name: 'startClosedLoop' },
+                { type: 'wait', duration: 30 },
+                { type: 'plugin', plugin_name: 'fictrac', command_name: 'stopClosedLoop' }
+            ]
+        };
+        const openCond = { name: 'open', commands: [trialCmd, { type: 'wait', duration: 30 }] };
+        const step = (name, i) => ({ kind: 'ref', conditionName: name, label: name, seqIdx: i });
+        const conds = new Map([
+            ['cl', clCond],
+            ['open', openCond]
+        ]);
+
+        console.log('\n=== sequenceUsesBridge: which runs depend on the bridge ===');
+        const ft = new Set(['fictrac']);
+        check(
+            'closed-loop condition → true',
+            Runner.sequenceUsesBridge([step('cl', 0)], conds, ft),
+            true
+        );
+        check(
+            'open-loop only → false',
+            Runner.sequenceUsesBridge([step('open', 0)], conds, ft),
+            false
+        );
+        check(
+            'a LATER closed-loop condition counts (it would run blind)',
+            Runner.sequenceUsesBridge([step('open', 0), step('cl', 1)], conds, ft),
+            true
+        );
+        check(
+            'no fictrac plugin declared → false',
+            Runner.sequenceUsesBridge([step('cl', 0)], conds, null),
+            false
+        );
+
+        console.log(
+            '\n=== bridge lost mid closed-loop epoch → run STOPPED, outcome BRIDGE_LOST ==='
+        );
+        {
+            const link = makeFakeLink();
+            const bridge = lostBridge();
+            const runner = new Runner.ArenaRunner(link, Wire, bridge);
+            const phases = [];
+            const t0 = Date.now();
+            // Default abort-aware sleep: a 30 s epoch the loss must cut short.
+            const p = runner.runSequence({
+                steps: [step('cl', 0)],
+                conditionsByName: conds,
+                resolvePatternId: () => 1,
+                resolvePatternFrames: (cmd) => (cmd.command_name === 'trialParams' ? 20 : null),
+                fictracPluginNames: ft,
+                onProgress: (s) => phases.push(s)
+            });
+            await delay(30);
+            check('closed loop applying before the loss', bridge.apply, true);
+            const stopsBefore = link.sent.filter((b) => b[1] === 0x30).length;
+            // FicTracBridgeClient forces apply off before 'lost'; mirror that.
+            bridge.apply = false;
+            const action = runner.onBridgeLost({ code: 1006, apply: true, logFile: 'f.jsonl' });
+            check('onBridgeLost → aborted', action, 'aborted');
+            const summary = await p;
+            checkBool('the run ended promptly', Date.now() - t0 < 2000, Date.now() - t0 + ' ms');
+            check('summary.aborted', summary.aborted, true);
+            check('summary.fault stays null (not a controller fault)', summary.fault, null);
+            checkDeep(
+                'summary.bridgeLost carries the loss',
+                [summary.bridgeLost.kind, summary.bridgeLost.code, summary.bridgeLost.apply],
+                ['bridge_lost', 1006, true]
+            );
+            const stops = link.sent.filter((b) => b[1] === 0x30).length - stopsBefore;
+            checkBool('the display got a real STOP (the serial link is fine)', stops >= 1);
+            check('stopAcked', summary.stopAcked, true);
+            const iLost = phases.findIndex((s) => s.phase === 'bridge-lost');
+            const iEnd = phases.findIndex((s) => s.phase === 'aborted');
+            checkBool(
+                "a 'bridge-lost' event precedes the terminal 'aborted'",
+                iLost >= 0 && iLost < iEnd
+            );
+            check('bridge-lost event says stopped', phases[iLost].action, 'stopped');
+            check('the terminal event carries bridgeLost', !!phases[iEnd].summary.bridgeLost, true);
+            checkBool(
+                'no step after the loss ran (no stopClosedLoop → no step-done for later steps)',
+                !phases.some((s, i) => i > iLost && s.phase === 'trial-running')
+            );
+            check('apply is OFF after the run', bridge.apply, false);
+            check('run log outcome is BRIDGE_LOST', RunLog.deriveOutcome(summary), 'BRIDGE_LOST');
+            check('bridgeLostInfo getter', runner.bridgeLostInfo.code, 1006);
+            check('idle runner → onBridgeLost "idle"', runner.onBridgeLost({}), 'idle');
+
+            // The next run starts clean.
+            const s2 = await runner.runSequence({
+                steps: [step('open', 0)],
+                conditionsByName: conds,
+                resolvePatternId: () => 1,
+                sleep: () => Promise.resolve()
+            });
+            check('next run: no stale bridgeLost', s2.bridgeLost, undefined);
+            check('next run completes', RunLog.deriveOutcome(s2), 'COMPLETED');
+        }
+
+        console.log(
+            '\n=== bridge lost in an open-loop step BEFORE a closed-loop one → stopped ==='
+        );
+        {
+            const runner = new Runner.ArenaRunner(makeFakeLink(), Wire, lostBridge());
+            const phases = [];
+            const p = runner.runSequence({
+                steps: [step('open', 0), step('cl', 1)],
+                conditionsByName: conds,
+                resolvePatternId: () => 1,
+                resolvePatternFrames: () => 20,
+                fictracPluginNames: ft,
+                onProgress: (s) => phases.push(s)
+            });
+            await delay(30);
+            check('apply is off (open-loop step)', runner._bridge.apply, false);
+            check(
+                'onBridgeLost → aborted',
+                runner.onBridgeLost({ code: 1006, apply: false }),
+                'aborted'
+            );
+            const summary = await p;
+            check('outcome BRIDGE_LOST', RunLog.deriveOutcome(summary), 'BRIDGE_LOST');
+            checkBool(
+                'the closed-loop condition never started',
+                !phases.some((s) => s.phase === 'step-start' && s.index === 1)
+            );
+        }
+
+        console.log('\n=== recorded open-loop run (bridgeRequired) → stopped ===');
+        {
+            const runner = new Runner.ArenaRunner(makeFakeLink(), Wire, lostBridge());
+            const p = runner.runSequence({
+                steps: [step('open', 0)],
+                conditionsByName: conds,
+                resolvePatternId: () => 1,
+                bridgeRequired: true
+            });
+            await delay(30);
+            check('onBridgeLost → aborted', runner.onBridgeLost({ code: 1006 }), 'aborted');
+            check('outcome BRIDGE_LOST', RunLog.deriveOutcome(await p), 'BRIDGE_LOST');
+        }
+
+        console.log(
+            '\n=== test run that needs nothing from the bridge → continues, event recorded ==='
+        );
+        {
+            const runner = new Runner.ArenaRunner(makeFakeLink(), Wire, lostBridge());
+            const phases = [];
+            let release;
+            const gate = new Promise((r) => (release = r));
+            const p = runner.runSequence({
+                steps: [step('open', 0)],
+                conditionsByName: conds,
+                resolvePatternId: () => 1,
+                fictracPluginNames: ft,
+                onProgress: (s) => phases.push(s),
+                sleep: () => gate
+            });
+            await delay(10);
+            check('onBridgeLost → continued', runner.onBridgeLost({ code: 1006 }), 'continued');
+            release();
+            const summary = await p;
+            check('run completed', RunLog.deriveOutcome(summary), 'COMPLETED');
+            check('no bridgeLost on a continued run', summary.bridgeLost, undefined);
+            const ev = phases.find((s) => s.phase === 'bridge-lost');
+            check('a bridge-lost event says continued', ev && ev.action, 'continued');
+        }
+    }
+
     console.log('\n=== Summary ===');
     console.log(`${totalChecks - failures} / ${totalChecks} checks passed`);
     process.exit(failures === 0 ? 0 : 1);
diff --git a/tests/test-arena-session.js b/tests/test-arena-session.js
index a8deb8c9..74aa8c0d 100644
--- a/tests/test-arena-session.js
+++ b/tests/test-arena-session.js
@@ -669,6 +669,235 @@ function newSession(m) {
             '01 c2'
         );
     }
+    // ── LAB-303 S1: bridge lost mid-run → the runner decides, the page is told ──
+    console.log("\n=== bridge 'lost' → runner.onBridgeLost + session 'bridgelost' ===");
+    {
+        class MockBridge {
+            constructor() {
+                this._h = {};
+                this.logging = false;
+            }
+            on(ev, fn) {
+                (this._h[ev] = this._h[ev] || []).push(fn);
+                return () => {};
+            }
+            emit(ev, ...a) {
+                (this._h[ev] || []).forEach((fn) => fn(...a));
+            }
+            setApply() {}
+            log() {}
+        }
+        const mk = (proto) => {
+            const m = makeMocks();
+            Object.assign(m.RunnerLib.ArenaRunner.prototype, proto || {});
+            const s = new ArenaSession({
+                wire: { mark: 1 },
+                LinkClass: m.MockLink,
+                RunnerLib: m.RunnerLib,
+                BridgeClientLib: MockBridge
+            });
+            const got = [];
+            let states = 0;
+            s.on('bridgelost', (e) => got.push(e));
+            s.on('state', () => states++);
+            return { m, s, got, states: () => states };
+        };
+        // (a) a runner that knows the policy
+        {
+            const t = mk({
+                onBridgeLost(info) {
+                    this.lostInfo = info;
+                    return 'aborted';
+                }
+            });
+            t.s._runner._active = true;
+            const info = { code: 1006, apply: true };
+            t.s.bridge.emit('lost', info);
+            check('runner.onBridgeLost got the info', t.s._runner.lostInfo, info);
+            check("session re-emits 'bridgelost' with the runner's action", t.got, [
+                { info, action: 'aborted', running: true }
+            ]);
+            checkBool("'state' emitted", t.states() >= 1);
+            delete t.m.RunnerLib.ArenaRunner.prototype.onBridgeLost;
+        }
+        // (b) a stale-cache runner without onBridgeLost: an ACTIVE run is stopped anyway
+        {
+            const t = mk();
+            t.s._runner._active = true;
+            t.s.bridge.emit('lost', { code: 1006 });
+            checkBool('stale runner: stop() used', t.m.calls.includes('runner.stop'));
+            check('stale runner: action aborted', t.got[0].action, 'aborted');
+        }
+        // (c) idle: nothing to stop, the page still hears it (Console closed loop)
+        {
+            const t = mk();
+            t.s.bridge.emit('lost', { code: 1006, apply: true });
+            checkBool('idle: no stop()', !t.m.calls.includes('runner.stop'));
+            check('idle: action idle', t.got[0].action, 'idle');
+            check('idle: info.apply passes through', t.got[0].info.apply, true);
+        }
+        // (d) runSequence forwards bridgeRequired; the sanitizer keeps the loss
+        {
+            const t = mk();
+            await t.s.connect();
+            await t.s.runSequence({ steps: [], conditionsByName: new Map(), bridgeRequired: true });
+            check('runSequence forwards bridgeRequired', t.s._runner.lastSeq.bridgeRequired, true);
+            const out = t.s._sanitizeRunStatus({
+                phase: 'aborted',
+                summary: {
+                    aborted: true,
+                    fault: null,
+                    bridgeLost: { kind: 'bridge_lost', code: 1006 }
+                }
+            });
+            check('sanitizer keeps summary.bridgeLost', out.summary.bridgeLost, {
+                kind: 'bridge_lost',
+                code: 1006
+            });
+            const ev = t.s._sanitizeRunStatus({ phase: 'bridge-lost', action: 'stopped' });
+            check('sanitizer keeps the bridge-lost action', ev.action, 'stopped');
+        }
+    }
+
+    console.log('\n=== end to end: bridge socket killed mid closed-loop epoch (ww18 step 5.7) ===');
+    {
+        const Runner = require('../js/arena-runner-g6.js');
+        const Wire = require('../js/arena-wire-g6.js');
+        const Client = require('../js/fictrac-bridge-client.js');
+        const RunLog = require('../js/run-log.js');
+        const Adapter = require('../js/studio-runlog-adapter.js');
+        class FakeWS {
+            constructor(url) {
+                FakeWS.last = this;
+                this.url = url;
+                this.readyState = 0;
+                this.sent = [];
+            }
+            send(s) {
+                this.sent.push(JSON.parse(s));
+            }
+            close() {
+                this.readyState = 3;
+                if (this.onclose) this.onclose({ code: 1000, wasClean: true });
+            }
+        }
+        class TestClient extends Client {
+            constructor(o) {
+                super(Object.assign({ WebSocketImpl: FakeWS }, o));
+            }
+        }
+        class Link {
+            constructor() {
+                this._open = false;
+                this.sent = [];
+            }
+            get connected() {
+                return this._open;
+            }
+            async connect() {
+                this._open = true;
+            }
+            async close() {
+                this._open = false;
+            }
+            async send(bytes) {
+                this.sent.push(Array.from(bytes));
+                return new Uint8Array([0x02, 0x00, bytes[1]]); // OK ack, echo = cmd
+            }
+        }
+        const s = new ArenaSession({
+            wire: Wire,
+            LinkClass: Link,
+            RunnerLib: Runner,
+            BridgeClientLib: TestClient
+        });
+        await s.connect();
+        const bridge = s.bridge;
+        bridge.connect('ws://localhost:8765');
+        const ws = FakeWS.last;
+        ws.readyState = 1;
+        ws.onopen();
+        bridge.setLogging(true);
+        ws.onmessage({
+            data: JSON.stringify({
+                type: 'log_control_ack',
+                enabled: true,
+                level: 'behavior_v2',
+                requested: 'behavior_v2',
+                file: 'arena-log-20261015-153548-287.jsonl'
+            })
+        });
+        const log = RunLog.createRunLog({ meta: { run_id: 'r1' }, intent: 'experiment' });
+        let outcome = null;
+        s.on('runstatus', (st) => {
+            const r = Adapter.feedRunStatus(log, st);
+            if (r.terminal) outcome = r.summary.outcome;
+        });
+        const lostEvents = [];
+        s.on('bridgelost', (e) => lostEvents.push(e));
+        const cl = {
+            name: 'cl',
+            commands: [
+                {
+                    type: 'controller',
+                    command_name: 'trialParams',
+                    mode: 3,
+                    frame_rate: 0,
+                    gain: 0,
+                    frame_index: 0,
+                    duration: 30,
+                    pattern: 'p'
+                },
+                { type: 'plugin', plugin_name: 'fictrac', command_name: 'startClosedLoop' },
+                { type: 'wait', duration: 30 },
+                { type: 'plugin', plugin_name: 'fictrac', command_name: 'stopClosedLoop' }
+            ]
+        };
+        const t0 = Date.now();
+        const run = s.runSequence({
+            steps: [{ kind: 'ref', conditionName: 'cl', label: 'cl', seqIdx: 0 }],
+            conditionsByName: new Map([['cl', cl]]),
+            resolvePatternId: () => 1,
+            resolvePatternFrames: () => 20,
+            fictracPluginNames: new Set(['fictrac'])
+        });
+        await new Promise((r) => setTimeout(r, 30));
+        checkBool('closed loop live before the kill', bridge.apply === true && s.running);
+        // A request waiting on the bridge when it dies (15 s timeout) must fail at once.
+        let exportErr = null;
+        const exp = bridge.exportLog(15000).catch((e) => (exportErr = e.message));
+        // taskkill /F on the bridge: the socket closes; nobody called disconnect().
+        ws.readyState = 3;
+        ws.onclose({ code: 1006, reason: '', wasClean: false });
+        const summary = await run;
+        await exp;
+        checkBool('run ended promptly (not after the 30 s epoch)', Date.now() - t0 < 2000);
+        check('outcome recorded in the run log: BRIDGE_LOST', outcome, 'BRIDGE_LOST');
+        check('runner summary outcome', RunLog.deriveOutcome(summary), 'BRIDGE_LOST');
+        check(
+            'loss names the run’s bridge file',
+            summary.bridgeLost && summary.bridgeLost.logFile,
+            'arena-log-20261015-153548-287.jsonl'
+        );
+        check(
+            'page told: action aborted',
+            lostEvents.map((e) => e.action),
+            ['aborted']
+        );
+        checkBool(
+            'pending export failed fast with "bridge lost"',
+            /bridge lost/.test(exportErr),
+            exportErr
+        );
+        check('closed loop is off', bridge.apply, false);
+        check('run no longer active', s.running, false);
+        checkBool(
+            'the display got STOP over the (healthy) serial link',
+            s._link.sent.some((b) => b[1] === 0x30)
+        );
+        checkBool('transcript shows the loss', /BRIDGE LOST/.test(log.toText()), log.toText());
+    }
+
     console.log('\n=== Summary ===');
     console.log(`${totalChecks - failures} / ${totalChecks} checks passed`);
     process.exit(failures === 0 ? 0 : 1);
diff --git a/tests/test-fictrac-bridge-client.js b/tests/test-fictrac-bridge-client.js
index 1eaec782..ed1be6b9 100644
--- a/tests/test-fictrac-bridge-client.js
+++ b/tests/test-fictrac-bridge-client.js
@@ -368,13 +368,138 @@ async function main() {
         await p4.catch((e) => (err4 = e.message));
         checkBool('timeout rejects', /timed out/.test(err4), err4);
 
-        // disconnect-while-pending path
+        // the socket drops while pending (the bridge went away) → "bridge lost"
         const p5 = client.exportLog(5000);
         ws.close();
         let err5 = null;
         await p5.catch((e) => (err5 = e.message));
-        checkBool('disconnect rejects pending export', /disconnected/.test(err5), err5);
+        checkBool('a dropped socket rejects pending export', /bridge lost/.test(err5), err5);
+        // the operator disconnects while pending → "disconnected"
+        client.connect('ws://localhost:8765');
+        FakeWS.last.open();
+        const p6 = client.exportLog(5000);
+        client.disconnect();
+        let err6 = null;
+        await p6.catch((e) => (err6 = e.message));
+        checkBool('disconnect() rejects pending export', /disconnected/.test(err6), err6);
+    }
+
+    // ── LAB-303 S1 (ww18, 2026-10-15): the bridge was hard-killed mid closed loop and
+    // the Studio only showed "bridge disconnected" — no event the runner could act on.
+    console.log('\n=== bridge LOST: unexpected close → fail closed, fail pending, then "lost" ===');
+    {
+        const applied = [];
+        const client = new FicTracBridgeClient({
+            WebSocketImpl: FakeWS,
+            applyFrame: (i) => {
+                applied.push(i);
+                return Promise.resolve();
+            },
+            clampFrame: (i) => i
+        });
+        const lost = [];
+        const applyEvents = [];
+        const logs = [];
+        let applyAtLost = null;
+        let exportSettledAtLost = false;
+        client.on('apply', (on) => applyEvents.push(on));
+        client.on('log', (m, k) => logs.push([k, m]));
+        client.connect('ws://localhost:8765');
+        const ws = FakeWS.last;
+        ws.open();
+        client.setLogging(true);
+        ws.message({
+            type: 'log_control_ack',
+            enabled: true,
+            level: 'behavior_v2',
+            requested: 'behavior_v2',
+            file: 'arena-log-20261015-153548-287.jsonl'
+        });
+        check('logFile from the ack', client.logFile, 'arena-log-20261015-153548-287.jsonl');
+        client.setApply(true);
+        client.handleFrame(4, { type: 'frame', index: 4 });
+        await tick();
+        check('closed loop applying before the loss', applied, [4]);
+        // A pending export (15 s default timeout) and a pending level ack.
+        const t0 = Date.now();
+        let exportErr = null;
+        const exp = client.exportLog(15000).catch((e) => (exportErr = e.message));
+        client.setLogging(true); // re-request → the ack is pending again
+        const ack = client.waitForLogLevelAck(15000);
+        client.on('lost', (info) => {
+            lost.push(info);
+            applyAtLost = client.apply;
+            exportSettledAtLost = exportErr !== null || client._exportPending === null;
+        });
+        // The bridge process dies: the socket closes without disconnect() asking.
+        ws.readyState = 3;
+        ws.onclose({ code: 1006, reason: '', wasClean: false });
+        await exp;
+        check('one "lost" event', lost.length, 1);
+        check(
+            'lost info names the close + that a closed loop was running',
+            [lost[0].code, lost[0].wasClean, lost[0].apply, lost[0].url],
+            [1006, false, true, 'ws://localhost:8765']
+        );
+        check('apply was already OFF when "lost" fired (fail closed first)', applyAtLost, false);
+        check('…and an apply:false event went out', applyEvents[applyEvents.length - 1], false);
+        checkBool('pending export already settled when "lost" fired', exportSettledAtLost);
+        checkBool(
+            'pending export rejected at once with "bridge lost" (not after its 15 s timeout)',
+            /bridge lost/.test(exportErr) && Date.now() - t0 < 1000,
+            exportErr + ' after ' + (Date.now() - t0) + ' ms'
+        );
+        check('pending level-ack waiter resolved null at once', await ack, null);
+        check('connected false', client.connected, false);
+        check('logFile cleared', client.logFile, null);
+        check('lastLoss kept for the page', client.lastLoss && client.lastLoss.code, 1006);
+        checkBool(
+            'an err log line says the bridge was lost',
+            logs.some(([k, m]) => k === 'err' && /bridge lost/.test(m)),
+            JSON.stringify(logs)
+        );
+        // A frame arriving after the loss (it cannot, but a stray one must not drive).
+        client.handleFrame(9, { type: 'frame', index: 9 });
+        await tick();
+        check('nothing applied after the loss', applied, [4]);
+    }
+
+    console.log('\n=== bridge LOST is only an UNEXPECTED close of an OPEN socket ===');
+    {
+        const client = new FicTracBridgeClient({ WebSocketImpl: FakeWS });
+        let lost = 0;
+        client.on('lost', () => lost++);
+        // (a) the operator disconnects: FakeWS fires onclose synchronously inside close()
+        client.connect('ws://localhost:8765');
+        FakeWS.last.open();
+        client.disconnect();
+        check('disconnect() → no "lost"', lost, 0);
+        check('disconnect() → lastLoss stays null', client.lastLoss, null);
+        // (b) a connect attempt that never opened (bridge not running) is not a loss
+        client.connect('ws://localhost:8765');
+        const never = FakeWS.last;
+        never.readyState = 3;
+        never.onclose({ code: 1006 });
+        check('failed connect → no "lost"', lost, 0);
+        // (c) a superseded socket closing after a reconnect leaves the new one alone
+        client.connect('ws://localhost:8765');
+        const oldWs = FakeWS.last;
+        oldWs.open();
+        oldWs.close = function () {
+            this.readyState = 2; // a real browser fires onclose later, asynchronously
+        };
         client.disconnect();
+        client.connect('ws://localhost:8765');
+        const newWs = FakeWS.last;
+        newWs.open();
+        oldWs.readyState = 3;
+        oldWs.onclose({ code: 1000 });
+        checkBool('stale close leaves the new socket connected', client.connected === true);
+        check('stale close → no "lost"', lost, 0);
+        newWs.readyState = 3;
+        newWs.onclose({ code: 1006 });
+        check('the live socket dropping IS a loss', lost, 1);
+        check('apply was off → info.apply false', client.lastLoss.apply, false);
     }
 
     console.log('\n=== log level (behavior_v2 default / v1 + full selectable) ===');
diff --git a/tests/test-run-log.js b/tests/test-run-log.js
index 62252721..5bed4c79 100644
--- a/tests/test-run-log.js
+++ b/tests/test-run-log.js
@@ -62,6 +62,16 @@ check(
     RunLog.deriveOutcome({ aborted: true, fault: 'controller_unresponsive' }),
     'CONTROLLER_FAULT'
 );
+check(
+    'deriveOutcome bridge lost beats aborted (LAB-303 S1)',
+    RunLog.deriveOutcome({ aborted: true, bridgeLost: { kind: 'bridge_lost' } }),
+    'BRIDGE_LOST'
+);
+check(
+    'deriveOutcome controller fault beats bridge lost',
+    RunLog.deriveOutcome({ aborted: true, fault: 'link_dropped', bridgeLost: { code: 1006 } }),
+    'CONTROLLER_FAULT'
+);
 check('deriveOutcome errors', RunLog.deriveOutcome({ errors: 2 }), 'ERRORED');
 check('deriveOutcome completed', RunLog.deriveOutcome({ completed: true }), 'COMPLETED');
 check(
diff --git a/tests/test-studio-runlog-adapter.js b/tests/test-studio-runlog-adapter.js
index 9c1ad4a1..1607ba85 100644
--- a/tests/test-studio-runlog-adapter.js
+++ b/tests/test-studio-runlog-adapter.js
@@ -222,6 +222,45 @@ console.log('\n=== controller fault outcome ===');
     check('plain abort stays ABORTED_BY_USER', log3.summary.outcome, 'ABORTED_BY_USER');
 }
 
+console.log('\n=== bridge lost mid-run (LAB-303 S1) → BRIDGE_LOST, never ABORTED_BY_USER ===');
+{
+    const log = RunLog.createRunLog({
+        meta: { protocol: 'p', run_id: 'r4', bench_id: 'b' },
+        intent: 'experiment',
+        now: fixedClock()
+    });
+    const lost = {
+        phase: 'bridge-lost',
+        reason: 'bridge_lost',
+        action: 'stopped',
+        detail: { kind: 'bridge_lost', code: 1006, apply: true }
+    };
+    const f = A.feedRunStatus(log, lost);
+    checkBool('bridge-lost phase is recorded (not dropped as unknown)', !!f.event);
+    check('bridge-lost is not terminal', f.terminal, false);
+    const r = A.feedRunStatus(log, {
+        phase: 'aborted',
+        summary: { aborted: true, fault: null, bridgeLost: lost.detail, stopAcked: true }
+    });
+    check('aborted-with-bridgeLost is terminal', r.terminal, true);
+    check('outcome BRIDGE_LOST', log.summary.outcome, 'BRIDGE_LOST');
+    checkBool(
+        'transcript names the loss and the stop',
+        /BRIDGE LOST \(code 1006\) — closed loop was running — run stopped/.test(log.toText()),
+        log.toText()
+    );
+    // A continued test run records the event; its outcome is whatever the run became.
+    const log2 = RunLog.createRunLog({ meta: { run_id: 'r5' }, intent: 'test', now: fixedClock() });
+    A.feedRunStatus(log2, Object.assign({}, lost, { action: 'continued' }));
+    A.feedRunStatus(log2, { phase: 'sequence-complete', summary: { completed: true } });
+    check('continued test run → COMPLETED', log2.summary.outcome, 'COMPLETED');
+    checkBool(
+        'its transcript says logging stopped',
+        /no longer logged by the bridge/.test(log2.toText()),
+        log2.toText()
+    );
+}
+
 console.log('\n=== Summary ===');
 console.log(`${totalChecks - failures} / ${totalChecks} checks passed`);
 process.exit(failures ? 1 : 0);

From 0ed962a942fc3ed1518bb7a7f01e34f1779ef53a Mon Sep 17 00:00:00 2001
From: Michael B Reiser <mreiser@gmail.com>
Date: Thu, 15 Oct 2026 16:53:27 -0400
Subject: [PATCH 2/3] Studio: a ?p= link no longer waits on a GitHub listing
 (LAB-303 S2)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ww18 2026-10-15: a tab opened at ?p=<key> stayed empty until a refresh. initFromUrl
AWAITED the course repo's GitHub patterns/ listing (registerRepoSharedPatternPreviews,
no timeout; a course repo is configured by default) before loading the protocol.
Reproduced headless: with api.github.com held the page was still empty at 9 s and
loaded 0.1 s after that request failed.

- initFromUrl starts the shared + colocated preview listings without awaiting them.
- That is only safe because preview byte sources no longer rely on "last write
  wins": new js/studio-preview-sources.js keeps them in layers (builtin < shared <
  colocated < uploaded) and every write names its layer, so a late shared listing
  can no longer override a protocol's colocated patterns (the replay path already
  had that race). Overlapping shared listings: the newest request wins.
- tests/test-studio-preview-sources.js: precedence in all 24 arrival orders, layer
  replacement, Map-like reads, and source guards — everything initFromUrl awaits
  before the ?p= load is allowlisted (fails on main's Studio, as it should).
  test-studio-github.js: the lazy-token check follows the new source forms.

Headless (GitHub held): ?p= loads in 0.09 s; previews wire once the listing answers;
no console errors. Suite 61/61.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CLAUDE.md                            |   6 +
 arena_studio.html                    |  41 +++---
 js/studio-preview-sources.js         | 100 +++++++++++++++
 tests/test-studio-github.js          |  11 +-
 tests/test-studio-preview-sources.js | 182 +++++++++++++++++++++++++++
 5 files changed, 317 insertions(+), 23 deletions(-)
 create mode 100644 js/studio-preview-sources.js
 create mode 100644 tests/test-studio-preview-sources.js

diff --git a/CLAUDE.md b/CLAUDE.md
index b9225d6b..8f113332 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -355,6 +355,12 @@ fix flows to every page automatically; two hand-written HTML pages never will.
   `BRIDGE_LOST` (`summary.bridgeLost`; `run-log.js` + adapter) is NOT auto-committed, and a push
   refuses a `log_export` whose name ≠ the run's `log.bridgeFile` (a restarted bridge serves another
   file). Studio: persistent `#runAlert` (`Studio.showRunAlert`), not the auto-hiding `#banner`.
+- **Never await a remote call before the `?p=` load (LAB-303 S2).** `initFromUrl` awaited the course
+  repo's GitHub `patterns/` listing first, so a stalled api.github.com request left `?p=` links
+  empty until a refresh. Best-effort listings are now fire-and-forget; that is safe because
+  pattern-preview byte sources are LAYERED (`js/studio-preview-sources.js`: builtin < shared <
+  colocated < uploaded — every write names its layer, arrival order never decides). The awaits
+  before the load are allowlisted in `tests/test-studio-preview-sources.js`.
 - **Wire module exports:** `js/arena-wire-g6.js` defines more than it exports —
   when adding encoders/decoders, add them to the export list AND a test; audit
   with `Object.keys(require('./js/arena-wire-g6.js'))` vs the page's `Wire.*`
diff --git a/arena_studio.html b/arena_studio.html
index 76753923..60add590 100644
--- a/arena_studio.html
+++ b/arena_studio.html
@@ -3392,6 +3392,7 @@ <h2 id="modalTitle">Import error</h2>
 <script src="js/studio-meta.js"></script>
 <script src="js/studio-url-state.js?v=20260924-replay"></script>
 <script src="js/studio-runlog-adapter.js?v=20261015-bridge-lost"></script>
+<script src="js/studio-preview-sources.js?v=20261015-s2"></script> <!-- pattern-preview byte sources, layered (builtin < shared < colocated < uploaded) -->
 <script src="js/studio-postmortem.js"></script>
 <script src="js/arena-telemetry.js"></script>
 <script src="js/trial-quality.js"></script>
@@ -7962,8 +7963,11 @@ <h2 id="modalTitle">Import error</h2>
 const PP = window.PatPreview;
 const BUILTIN_BASE = './patterns/g6_2x10/';
 Studio.patternSet = null;
-const webPreviewBySdName = new Map(); // filename → () => Promise<ArrayBuffer>
-const repoSharedPreviewKeys = new Set(); // sources currently wired from course-repo patterns/
+// filename → () => Promise<ArrayBuffer>, LAYERED so precedence never depends on which
+// listing arrives first: builtin < shared (repo patterns/) < colocated (<proto>_patterns/)
+// < uploaded (js/studio-preview-sources.js). Reads see the effective source per filename.
+const webPreviewBySdName = window.StudioPreviewSources.create();
+let sharedPreviewGen = 0; // the newest shared-library listing wins; an older reply is dropped
 // In-memory sources first (logical-name tolerant via webBytesForName). `idx`
 // (1-based SD index) is the fallback path: a pattern already on the card
 // from a prior session has no cached source above, so fetch it live via 0x84
@@ -8286,7 +8290,7 @@ <h2 id="modalTitle">Import error</h2>
         const buf = u8.byteOffset === 0 && u8.byteLength === u8.buffer.byteLength
             ? u8.buffer
             : u8.slice().buffer;
-        webPreviewBySdName.set(f.name, () => Promise.resolve(buf));
+        webPreviewBySdName.set('uploaded', f.name, () => Promise.resolve(buf));
     });
     patPreviewCache = {}; // drop cached renders so the new sources take effect
     const sel = $('cPatName');
@@ -8301,7 +8305,7 @@ <h2 id="modalTitle">Import error</h2>
         m.source = 'manifest';
         for (const n of Object.keys(m.patterns)) {
             const sd = m.patterns[n].sd_name;
-            webPreviewBySdName.set(sd, async () => {
+            webPreviewBySdName.set('builtin', sd, async () => {
                 const r = await fetch(BUILTIN_BASE + 'patterns/' + sd, { cache: 'no-store' });
                 if (!r.ok) throw new Error('HTTP ' + r.status);
                 return r.arrayBuffer();
@@ -11040,23 +11044,20 @@ <h2 id="modalTitle">Import error</h2>
 // as soon as its filename matches the repo library. Bytes stay lazy: this
 // request lists names only; the selected .pat is downloaded on first preview.
 // Public repos work signed out, while a token transparently enables private
-// repos. Protocol-colocated sources are registered afterwards and may
-// intentionally override a shared file with the same name.
+// repos. Protocol-colocated sources override a shared file with the same name
+// whenever either listing arrives (the 'colocated' layer outranks 'shared').
 async function registerRepoSharedPatternPreviews(repo, token) {
     if (!repo) return;
+    const gen = ++sharedPreviewGen;
     try {
         const res = await GH.run(fetch, GH.reqGetContents(repo.owner, repo.name, 'patterns', null, token));
+        if (gen !== sharedPreviewGen) return; // a newer listing (repo change / sign-in) was requested
         if (!res.ok || !Array.isArray(res.data)) return;
-        for (const key of repoSharedPreviewKeys) webPreviewBySdName.delete(key);
-        repoSharedPreviewKeys.clear();
-        let n = 0;
-        res.data
+        const entries = res.data
             .filter((f) => f && f.type === 'file' && /\.pat$/i.test(f.name))
-            .forEach((f) => {
-                n++;
-                repoSharedPreviewKeys.add(f.name);
-                webPreviewBySdName.set(f.name, () => repoFileBytes(repo, f.path));
-            });
+            .map((f) => [f.name, () => repoFileBytes(repo, f.path)]);
+        webPreviewBySdName.replaceLayer('shared', entries);
+        const n = entries.length;
         if (n) {
             patPreviewCache = {};
             const sel = $('cPatName');
@@ -11090,7 +11091,7 @@ <h2 id="modalTitle">Import error</h2>
             .forEach((f) => {
                 n++;
                 names.add(sdLogicalName(f.name));
-                webPreviewBySdName.set(f.name, () => repoFileBytes(repo, f.path));
+                webPreviewBySdName.set('colocated', f.name, () => repoFileBytes(repo, f.path));
             });
         if (n) {
             // The colocated _patterns/ set IS this protocol's web pattern set
@@ -11355,8 +11356,12 @@ <h2 id="modalTitle">Import error</h2>
         await populateSessionRig();
         wirePatPicker();
         loadBuiltinPatternSet();
-        await refreshRepoSharedPatternPreviews(); // shared patterns/ previews do not depend on a protocol
-        rewireRepoPatternPreviews(); // restore last-opened course protocol's colocated thumbs
+        // Best-effort GitHub listings — NEVER awaited here: a stalled api.github.com request
+        // used to hold the `?p=` load below until the page was refreshed (LAB-303 S2, ww18
+        // 2026-10-15). Order no longer matters: preview sources are layered, so a late shared
+        // listing cannot override the colocated sources rewired here.
+        refreshRepoSharedPatternPreviews().catch(() => {}); // shared patterns/ previews
+        rewireRepoPatternPreviews().catch(() => {}); // restore last-opened course protocol's colocated thumbs
         let allowedKeys = [];
         let protoIndex = [];
         try {
diff --git a/js/studio-preview-sources.js b/js/studio-preview-sources.js
new file mode 100644
index 00000000..a22ad5ac
--- /dev/null
+++ b/js/studio-preview-sources.js
@@ -0,0 +1,100 @@
+/**
+ * studio-preview-sources.js — where a pattern thumbnail's bytes come from (Arena Studio).
+ *
+ * The Studio previews a pattern by FILENAME from several byte sources that arrive at
+ * different times: the site's built-in library (a same-origin manifest), the course
+ * repo's shared `patterns/` folder (a GitHub listing), an opened protocol's colocated
+ * `<proto>_patterns/` folder (another GitHub listing) and bytes uploaded to the SD card
+ * this session. When two sources share a filename the more specific one must win:
+ *
+ *     builtin  <  shared  <  colocated  <  uploaded        (low → high precedence)
+ *
+ * This used to be "last write wins" on one Map, which only came out right because the
+ * Studio AWAITED the shared GitHub listing before loading a `?p=` protocol. That await
+ * is what left a `?p=` link empty until a refresh when api.github.com stalled (LAB-303
+ * S2, ww18 2026-10-15). Layers make the precedence independent of arrival order, so no
+ * best-effort listing has to gate the page.
+ *
+ * The registry reads like a Map of the EFFECTIVE sources: get / has / iteration
+ * (`for (const [name, fn] of reg)`) see one entry per filename, from the highest layer
+ * that has it. Writes name their layer: set(layer, name, fn), replaceLayer(layer, entries).
+ *
+ * LOADING: classic <script src> (window-global + CommonJS dual-export, no ES `export`).
+ */
+(function (global) {
+    'use strict';
+
+    const LAYERS = ['builtin', 'shared', 'colocated', 'uploaded'];
+
+    function create(layers) {
+        const order = Array.isArray(layers) && layers.length ? layers.slice() : LAYERS.slice();
+        const maps = new Map(order.map((l) => [l, new Map()]));
+        const byPrecedence = order.slice().reverse();
+        const layerMap = (layer) => {
+            const m = maps.get(layer);
+            if (!m) throw new Error('StudioPreviewSources: unknown layer "' + layer + '"');
+            return m;
+        };
+        const layerOf = (name) => {
+            for (const l of byPrecedence) if (maps.get(l).has(name)) return l;
+            return null;
+        };
+        return {
+            /** Register one source in `layer` (replaces that layer's entry for `name`). */
+            set(layer, name, fn) {
+                layerMap(layer).set(name, fn);
+                return this;
+            },
+            /** Drop one layer's entries and install `entries` ([name, fn] pairs) instead. */
+            replaceLayer(layer, entries) {
+                const m = layerMap(layer);
+                m.clear();
+                for (const [name, fn] of entries || []) m.set(name, fn);
+                return this;
+            },
+            clearLayer(layer) {
+                layerMap(layer).clear();
+                return this;
+            },
+            /** The effective source for `name` (highest layer), or undefined. */
+            get(name) {
+                const l = layerOf(name);
+                return l ? maps.get(l).get(name) : undefined;
+            },
+            has(name) {
+                return layerOf(name) !== null;
+            },
+            /** Which layer serves `name` now, or null. */
+            layerOf,
+            /** Filenames registered in one layer. */
+            namesIn(layer) {
+                return Array.from(layerMap(layer).keys());
+            },
+            get size() {
+                const names = new Set();
+                for (const m of maps.values()) for (const k of m.keys()) names.add(k);
+                return names.size;
+            },
+            /** Effective [name, fn] pairs, one per filename. */
+            *[Symbol.iterator]() {
+                const seen = new Set();
+                for (const l of byPrecedence) {
+                    for (const [name, fn] of maps.get(l)) {
+                        if (seen.has(name)) continue;
+                        seen.add(name);
+                        yield [name, fn];
+                    }
+                }
+            }
+        };
+    }
+
+    const StudioPreviewSources = { create, LAYERS: LAYERS.slice() };
+
+    if (typeof module !== 'undefined' && module.exports) {
+        module.exports = StudioPreviewSources;
+    }
+    if (typeof global !== 'undefined') {
+        global.StudioPreviewSources = StudioPreviewSources;
+    }
+})(typeof window !== 'undefined' ? window : this);
diff --git a/tests/test-studio-github.js b/tests/test-studio-github.js
index 67363ae3..1bf145d4 100644
--- a/tests/test-studio-github.js
+++ b/tests/test-studio-github.js
@@ -244,11 +244,12 @@ checkBool(
     'lazy repo pattern fetches resolve the current token instead of retaining one',
     rfbStart > 0 &&
         /^\s*const token = ghToken\(\);/m.test(rfbBody) &&
-        (
-            studioHtml.match(
-                /webPreviewBySdName\.set\(f\.name, \(\) => repoFileBytes\(repo, f\.path\)\);/g
-            ) || []
-        ).length >= 2
+        // colocated _patterns/ (one source per file) …
+        studioHtml.includes(
+            "webPreviewBySdName.set('colocated', f.name, () => repoFileBytes(repo, f.path));"
+        ) &&
+        // … and the shared patterns/ layer (replaced as a whole per listing)
+        studioHtml.includes('.map((f) => [f.name, () => repoFileBytes(repo, f.path)]);')
 );
 checkBool(
     'anonymous pattern reads prefer raw.githubusercontent.com',
diff --git a/tests/test-studio-preview-sources.js b/tests/test-studio-preview-sources.js
new file mode 100644
index 00000000..9352abe3
--- /dev/null
+++ b/tests/test-studio-preview-sources.js
@@ -0,0 +1,182 @@
+#!/usr/bin/env node
+/**
+ * Tests for js/studio-preview-sources.js (layered pattern-preview byte sources) and
+ * the Studio contract around it (LAB-303 S2, ww18 2026-10-15): a `?p=` link stayed
+ * empty until a refresh because initFromUrl AWAITED a GitHub listing (the course
+ * repo's shared patterns/) before loading the protocol. The listing is now
+ * fire-and-forget, which is only safe because precedence no longer depends on which
+ * listing arrives first.
+ *
+ * Run: node tests/test-studio-preview-sources.js   (picked up by `pixi run test`)
+ */
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const Sources = require('../js/studio-preview-sources.js');
+
+let totalChecks = 0;
+let failures = 0;
+function check(name, got, expected) {
+    totalChecks++;
+    const ok = JSON.stringify(got) === JSON.stringify(expected);
+    console.log(
+        `  ${ok ? 'PASS' : 'FAIL'}  ${name}: got ${JSON.stringify(got)}, expected ${JSON.stringify(expected)}`
+    );
+    if (!ok) failures++;
+}
+function checkBool(name, ok, info) {
+    totalChecks++;
+    console.log(`  ${ok ? 'PASS' : 'FAIL'}  ${name}${!ok && info ? ' — ' + info : ''}`);
+    if (!ok) failures++;
+}
+const src = (tag) => () => tag; // a byte source stand-in that names its origin
+
+console.log('=== layers, low → high precedence ===');
+check('LAYERS', Sources.LAYERS, ['builtin', 'shared', 'colocated', 'uploaded']);
+
+console.log('\n=== precedence does not depend on arrival order ===');
+{
+    // Every permutation of the four layers registering the same filename.
+    const perms = (a) =>
+        a.length <= 1
+            ? [a]
+            : a.flatMap((x, i) => perms(a.filter((_, j) => j !== i)).map((p) => [x, ...p]));
+    let allOk = true;
+    for (const order of perms(Sources.LAYERS)) {
+        const r = Sources.create();
+        for (const layer of order) r.set(layer, '001_grating.pat', src(layer));
+        if (r.get('001_grating.pat')() !== 'uploaded') allOk = false;
+    }
+    checkBool('uploaded wins in all 24 arrival orders', allOk);
+
+    // THE S2 case: the colocated listing lands first, the shared listing late.
+    const r = Sources.create();
+    r.set('colocated', 'p3_heisenberg.pat', src('colocated'));
+    r.replaceLayer('shared', [
+        ['p3_heisenberg.pat', src('shared')],
+        ['only_shared.pat', src('shared')]
+    ]);
+    check(
+        'a late shared listing does not override colocated',
+        r.get('p3_heisenberg.pat')(),
+        'colocated'
+    );
+    check('…and still serves names only it has', r.get('only_shared.pat')(), 'shared');
+    check(
+        'layerOf',
+        [r.layerOf('p3_heisenberg.pat'), r.layerOf('only_shared.pat'), r.layerOf('x')],
+        ['colocated', 'shared', null]
+    );
+
+    const b = Sources.create();
+    b.set('shared', 'all_on.pat', src('shared'));
+    b.set('builtin', 'all_on.pat', src('builtin')); // the built-in manifest landing last
+    check(
+        'a late built-in manifest does not override the repo library',
+        b.get('all_on.pat')(),
+        'shared'
+    );
+}
+
+console.log('\n=== replaceLayer swaps one layer only ===');
+{
+    const r = Sources.create();
+    r.set('builtin', 'a.pat', src('builtin'));
+    r.replaceLayer('shared', [
+        ['a.pat', src('shared-1')],
+        ['b.pat', src('shared-1')]
+    ]);
+    r.set('colocated', 'c.pat', src('colocated'));
+    r.replaceLayer('shared', [['d.pat', src('shared-2')]]); // repo changed
+    check('old shared entries gone; builtin shows through again', r.get('a.pat')(), 'builtin');
+    check('b.pat (old repo only) is gone', r.has('b.pat'), false);
+    check('new shared entry', r.get('d.pat')(), 'shared-2');
+    check('colocated untouched', r.get('c.pat')(), 'colocated');
+    check('namesIn(shared)', r.namesIn('shared'), ['d.pat']);
+    r.clearLayer('colocated');
+    check('clearLayer', r.has('c.pat'), false);
+}
+
+console.log('\n=== reads look like a Map of the effective sources ===');
+{
+    const r = Sources.create();
+    r.set('builtin', 'x.pat', src('builtin'));
+    r.set('shared', 'x.pat', src('shared'));
+    r.set('builtin', 'y.pat', src('builtin'));
+    const seen = [];
+    for (const [name, fn] of r) seen.push(name + '=' + fn());
+    check('iteration: one entry per name, the effective one', seen.sort(), [
+        'x.pat=shared',
+        'y.pat=builtin'
+    ]);
+    check('size counts names, not entries', r.size, 2);
+    check('get of an unknown name', r.get('nope.pat'), undefined);
+    let threw = false;
+    try {
+        r.set('bogus', 'z.pat', src('z'));
+    } catch (_) {
+        threw = true;
+    }
+    check('an unknown layer throws (a typo must not silently mis-rank a source)', threw, true);
+}
+
+console.log('\n=== Studio contract (arena_studio.html source) ===');
+{
+    const studio = fs.readFileSync(path.join(__dirname, '..', 'arena_studio.html'), 'utf8');
+    const tag = studio.indexOf('<script src="js/studio-preview-sources.js');
+    const firstModule = studio.indexOf('<script type="module">');
+    checkBool(
+        'the module loads as a classic script before the module block',
+        tag > 0 && tag < firstModule
+    );
+
+    const writes = studio.match(/webPreviewBySdName\.set\(([^,]*),/g) || [];
+    checkBool(
+        'every webPreviewBySdName.set names a known layer',
+        writes.length >= 3 &&
+            writes.every((w) => Sources.LAYERS.some((l) => w.includes("'" + l + "'"))),
+        writes.join(' | ')
+    );
+    checkBool(
+        'the shared listing replaces its own layer and drops superseded replies',
+        studio.includes("webPreviewBySdName.replaceLayer('shared', entries);") &&
+            studio.includes('if (gen !== sharedPreviewGen) return;')
+    );
+
+    // Everything initFromUrl awaits BEFORE it loads `?p=` must be same-origin: a GitHub
+    // (or any remote) call here is what left the ww18 tab empty until a refresh.
+    const start = studio.indexOf('async function initFromUrl() {');
+    const pLoad = studio.indexOf('} else if (state.p) {', start);
+    const prefix = start > 0 && pLoad > start ? studio.slice(start, pLoad) : '';
+    checkBool('initFromUrl + its ?p= branch found', prefix.length > 0);
+    const awaited = (prefix.match(/await\s+[\w.]+\(/g) || []).map((s) =>
+        s.replace(/^await\s+/, '').replace(/\($/, '')
+    );
+    // `openFromCourseRepo` is the ?repo=&p= load itself (the protocol lives on GitHub).
+    const allowed = [
+        'populateMetaDatalists',
+        'populateSessionRig',
+        'fetch',
+        'res.json',
+        'openFromCourseRepo'
+    ];
+    checkBool(
+        'nothing else is awaited before the ?p= load',
+        awaited.every((a) => allowed.includes(a)),
+        JSON.stringify(awaited)
+    );
+    checkBool(
+        'the shared + colocated preview listings are started, not awaited',
+        /\n\s+refreshRepoSharedPatternPreviews\(\)\.catch\(/.test(prefix) &&
+            /\n\s+rewireRepoPatternPreviews\(\)\.catch\(/.test(prefix)
+    );
+    checkBool(
+        'the protocol registry fetch itself stays same-origin and uncached',
+        prefix.includes("await fetch('./protocols/index.json', { cache: 'no-store' })")
+    );
+}
+
+console.log('\n=== Summary ===');
+console.log(`${totalChecks - failures} / ${totalChecks} checks passed`);
+process.exit(failures ? 1 : 0);

From 0b1d2121e863dd6bf604f121aef4af7d0966d3b1 Mon Sep 17 00:00:00 2001
From: Michael B Reiser <mreiser@gmail.com>
Date: Sun, 18 Oct 2026 00:59:34 -0400
Subject: [PATCH 3/3] Studio/bridge client: review fixes for the bridge-loss
 policy (LAB-303 S1)

- bridgeRequired only for a recorded run the bridge is actually logging
  (bridge.logging), not merely connected for the scope.
- A log_control_ack slower than the 800 ms wait still names the run's bridge
  file: the run subscribes to 'loglevel' once and takes `file` for THIS run.
- disconnect() and a connect() over a still-closing socket settle every
  pending request (export, level ack) themselves; the superseded socket's
  late onclose is ignored, so it must not be the only place they settle.
- The bridge-lost alert no longer hardcodes `pixi run bridge` (wrong on the
  ROS 2 graph): "restart the bridge program on the rig PC".

Tests: client 187 (two new reconnect cases), studio-shell 81 (wiring checks).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 arena_studio.html                   | 22 ++++++++++++++-----
 js/fictrac-bridge-client.js         |  7 ++++++
 tests/test-fictrac-bridge-client.js | 33 +++++++++++++++++++++++++++++
 tests/test-studio-shell.js          | 17 +++++++++++++++
 4 files changed, 74 insertions(+), 5 deletions(-)

diff --git a/arena_studio.html b/arena_studio.html
index 60add590..fa96bffe 100644
--- a/arena_studio.html
+++ b/arena_studio.html
@@ -5799,7 +5799,7 @@ <h2 id="modalTitle">Import error</h2>
             const info = (e && e.info) || {};
             const action = e && e.action;
             const why = info.apply ? 'the closed loop was running' : 'the bridge connection dropped';
-            const restart = ' Restart the bridge (`pixi run bridge`) before the next run.';
+            const restart = ' Restart the bridge program on the rig PC before the next run.';
             let msg = null;
             if (action === 'aborted') {
                 msg = '⚠ FicTrac bridge lost mid-run (' + why + ') — the run was STOPPED (outcome BRIDGE_LOST). ' +
@@ -9869,7 +9869,18 @@ <h2 id="modalTitle">Import error</h2>
         Studio._runLogFormat = bridge.connected ? logLevel : null;
         // The file the bridge opened for THIS run (log_control_ack). A later push checks
         // that log_export serves it — a bridge restarted after a loss serves another file.
-        if (Studio.activeRunLog) Studio.activeRunLog.bridgeFile = (bridge.connected && bridge.logFile) || null;
+        if (Studio.activeRunLog) {
+            const runLog = Studio.activeRunLog;
+            runLog.bridgeFile = (bridge.connected && bridge.logFile) || null;
+            // A slow ack (> 800 ms on a loaded rig PC) names the file after this point: take
+            // it then, for THIS run only, so the push check is not silently skipped.
+            if (!runLog.bridgeFile && bridge.connected && typeof bridge.on === 'function') {
+                const off = bridge.on('loglevel', (info) => {
+                    if (Studio.activeRunLog !== runLog) { off(); return; }
+                    if (info && info.enabled && info.file) { runLog.bridgeFile = info.file; off(); }
+                });
+            }
+        }
         const levelNote = !bridge.connected ? ''
             : ackLevel === wantLevel ? ' (' + ackLevel + ')'
             : ackLevel ? ' ⚠ bridge too old for ' + wantLevel + ' — logging ' + ackLevel + ' (restart `pixi run bridge` from the current checkout)'
@@ -9946,9 +9957,10 @@ <h2 id="modalTitle">Import error</h2>
                 ? Studio.resolveRuntimeCondition
                 : undefined,
             fictracPluginNames: new Set(ftNames),
-            // A recorded run's record IS the bridge log (the run is gated on the bridge),
-            // so losing the bridge stops it — not only when a FicTrac step needs it.
-            bridgeRequired: !!isExperiment && !!(bridge && bridge.connected),
+            // A recorded run's record IS the bridge log (the run is gated on the bridge and
+            // the bridge is logging it), so losing the bridge stops it — not only when a
+            // FicTrac step needs it. With bridge logging off the record is in the browser.
+            bridgeRequired: !!isExperiment && !!(bridge && bridge.connected && bridge.logging),
             degPerFrame: Studio.rigDegPerFrame(),
             defaultCoupling: Studio._legacyDefaultCoupling == null ? 1 : Studio._legacyDefaultCoupling
         });
diff --git a/js/fictrac-bridge-client.js b/js/fictrac-bridge-client.js
index af5de421..d3230f42 100644
--- a/js/fictrac-bridge-client.js
+++ b/js/fictrac-bridge-client.js
@@ -307,6 +307,9 @@
                 this._emit('log', 'bridge: bad URL — ' + (e && (e.message || e)), 'err');
                 return;
             }
+            // Superseding a socket that is still closing: its waiters can never be answered
+            // by the new one, and its late onclose is ignored as stale (below).
+            if (this._ws) this._failPending('bridge reconnecting');
             this._ws = ws;
             this._recv = 0;
             this._applied = 0;
@@ -397,6 +400,10 @@
         disconnect() {
             const ws = this._ws;
             this._ws = null; // first: onclose may run synchronously, and must see a requested close
+            // A requested close kills every request still waiting on this socket (export,
+            // level ack): settle them NOW. Its onclose may arrive late or, after a reconnect,
+            // be ignored as stale — so it must not be the only place they settle.
+            if (ws) this._failPending('bridge disconnected');
             if (ws) {
                 try {
                     ws.close();
diff --git a/tests/test-fictrac-bridge-client.js b/tests/test-fictrac-bridge-client.js
index ed1be6b9..ed5f3d4d 100644
--- a/tests/test-fictrac-bridge-client.js
+++ b/tests/test-fictrac-bridge-client.js
@@ -488,10 +488,21 @@ async function main() {
         oldWs.close = function () {
             this.readyState = 2; // a real browser fires onclose later, asynchronously
         };
+        // A request still waiting on the old socket must fail fast at disconnect(): the
+        // old socket's late onclose is ignored as stale and the new one never answers it.
+        const staleExport = client.exportLog(5000).then(
+            () => 'resolved',
+            (e) => e.message
+        );
         client.disconnect();
         client.connect('ws://localhost:8765');
         const newWs = FakeWS.last;
         newWs.open();
+        check(
+            'export pending on the superseded socket fails fast',
+            await staleExport,
+            'bridge disconnected during log export'
+        );
         oldWs.readyState = 3;
         oldWs.onclose({ code: 1000 });
         checkBool('stale close leaves the new socket connected', client.connected === true);
@@ -500,6 +511,28 @@ async function main() {
         newWs.onclose({ code: 1006 });
         check('the live socket dropping IS a loss', lost, 1);
         check('apply was off → info.apply false', client.lastLoss.apply, false);
+        // (d) reconnecting OVER a socket that is still closing (no disconnect() call)
+        // settles the requests waiting on it; its late onclose is then ignored as stale.
+        client.connect('ws://localhost:8765');
+        const closing = FakeWS.last;
+        closing.open();
+        const exp2 = client.exportLog(5000).then(
+            () => 'resolved',
+            (e) => e.message
+        );
+        closing.readyState = 2; // CLOSING: connected === false, so connect() proceeds
+        client.connect('ws://localhost:8765');
+        const fresh = FakeWS.last;
+        fresh.open();
+        check(
+            'export pending on a closing socket fails on reconnect',
+            await exp2,
+            'bridge disconnected during log export'
+        );
+        closing.readyState = 3;
+        closing.onclose({ code: 1000 });
+        checkBool('the stale close leaves the fresh socket connected', client.connected === true);
+        check('stale close after a reconnect → still one loss', lost, 1);
     }
 
     console.log('\n=== log level (behavior_v2 default / v1 + full selectable) ===');
diff --git a/tests/test-studio-shell.js b/tests/test-studio-shell.js
index adb30fb7..71b6ab32 100644
--- a/tests/test-studio-shell.js
+++ b/tests/test-studio-shell.js
@@ -407,6 +407,23 @@ check(
         !/:root\[data-ui-theme="night"\] (img|canvas)\b/.test(studio) &&
         studio.includes('filter:url(#uiNightRed)')
 );
+console.log('=== bridge-loss policy wiring (LAB-303 S1 review) ===');
+check(
+    'bridgeRequired only for a recorded run the bridge is logging',
+    studio.includes(
+        'bridgeRequired: !!isExperiment && !!(bridge && bridge.connected && bridge.logging)'
+    )
+);
+check(
+    "a late log_control_ack still names the run's bridge file",
+    studio.includes("bridge.on('loglevel', (info) => {") &&
+        studio.includes('runLog.bridgeFile = info.file')
+);
+check(
+    'the bridge-lost alert does not hardcode a bridge command',
+    !/const restart = [^\n]*pixi run/.test(studio)
+);
+
 console.log('\n=== Summary ===');
 console.log(`${totalChecks - failures} / ${totalChecks} checks passed`);
 process.exit(failures ? 1 : 0);