@cortexkit/opencode-magic-context 0.45.0 → 0.46.1

package/src/shared/status-summary.ts

@@ -1,4 +1,5 @@
 import { formatCacheTtlDisplay } from "./cache-ttl-display";
+import { primaryQuotaDiagnostic } from "./quota-diagnostic";
 import type { RunnerStatus, StatusDetail } from "./rpc-types";
 import { renderUserFacingFailure, type UserFacingFailureKey } from "./user-facing-codes";
 
@@ -37,6 +38,7 @@ export interface UserStatusSummary {
     warnings: UserFacingFailureKey[];
     hiddenVariantWarnings?: string[];
     dreamerSkipped?: readonly string[];
+    dreamerQuotas?: readonly string[];
 }
 
 /**
@@ -129,6 +131,14 @@ export function statusSummaryFromDetail(detail: StatusDetail): UserStatusSummary
         warnings: statusWarningsFromDetail(detail),
         hiddenVariantWarnings: detail.hiddenVariantWarnings ?? [],
         dreamerSkipped: detail.dreamerSkipped,
+        dreamerQuotas: [
+            ...new Set(
+                (detail.dreamerFailures ?? []).flatMap((failure) => {
+                    const quota = primaryQuotaDiagnostic(failure.error);
+                    return quota ? [quota] : [];
+                }),
+            ),
+        ],
     };
 }
 
@@ -221,6 +231,7 @@ export function renderUserStatusSummary(
         values.push(["Dreamer runner", runnerText(summary.dreamerRunner)]);
     }
     for (const skipped of summary.dreamerSkipped ?? []) values.push(["Dreamer skipped", skipped]);
+    for (const quota of summary.dreamerQuotas ?? []) values.push(["Dreamer quota", quota]);
     if (summary.historianRefusal) {
         values.push([
             "Historian refusal",

package/src/shared/status-view-check.ts

@@ -312,6 +312,11 @@ export function checkStatusViewSource(candidate: unknown):
         lastDreamerRunAt: optional.read("lastDreamerRunAt", isNullableNumber),
         dreamerUnsupportedTasks: optional.readArray("dreamerUnsupportedTasks", isString),
         dreamerSkipped: optional.readArray("dreamerSkipped", isString),
+        dreamerFailures: optional.readArray(
+            "dreamerFailures",
+            (value): value is { task: string; error: string } =>
+                isRecord(value) && isString(value.task) && isString(value.error),
+        ),
         dreamerTickFailure: optional.read(
             "dreamerTickFailure",
             (value): value is NonNullable<StatusViewSource["dreamerTickFailure"]> | null =>

package/src/shared/status-view.test.ts

@@ -264,7 +264,7 @@ describe("status view model", () => {
      * gap fit; otherwise the caller draws one column.
      */
     test("draws two columns only when both columns' values fit", () => {
-        const sections = view().sections;
+        const sections = view({ cacheTtlSource: "default" }).sections;
         for (const section of sections) {
             const longest = Math.max(...section.rows.map((row) => row.value.length));
             expect(statusSectionWidth(section)).toBe(section.labelWidth + 1 + longest);
@@ -297,7 +297,7 @@ describe("status view model", () => {
         expect(statusColumnsFor(narrowValues, needed).twoColumn).toBe(true);
         expect(statusColumnsFor(narrowValues, needed - 1).twoColumn).toBe(false);
 
-        // A long value — the model key on the Configured row — pushes the left
+        // A long value — the frozen-default source on the Configured row — pushes the left
         // column past what the dialog has, so the same sections go one column
         // rather than wrapping that value mid-word.
         expect(statusColumnsFor(sections, 84).twoColumn).toBe(false);
@@ -398,6 +398,15 @@ describe("status view model", () => {
      * (issue 496).
      */
     describe("blocked background maintenance", () => {
+        test("shows a scheduled task's primary quota deadline in the status dialog", () => {
+            const error =
+                "primary quota exhausted until 2026-10-08T03:40:04.275Z; account=private@example.com";
+            const row = view({ dreamerFailures: [{ task: "verify", error }] })
+                .sections.find((section) => section.title === "History Compression")
+                ?.rows.find((entry) => entry.label === "Dreamer quota");
+            expect(row?.value).toBe("primary quota exhausted until 2026-10-08T03:40:04.275Z");
+            expect(row?.tone).toBe("warning");
+        });
         const failure = {
             at: NOW - 2 * 3_600_000,
             stage: "message-history maintenance",

package/src/shared/status-view.ts

@@ -17,6 +17,7 @@ import type { DreamerTickFailure } from "../features/magic-context/dreamer/tick-
 import { formatCacheTtlDisplay } from "./cache-ttl-display";
 import { type ConfigParseFailure, formatConfigParseStatusLine } from "./config-diagnostics";
 import { formatThresholdPercent } from "./format-threshold";
+import { primaryQuotaDiagnostic } from "./quota-diagnostic";
 import type { TailHygieneStatus } from "./rpc-types";
 import {
     type StatusCheck,
@@ -153,6 +154,7 @@ export interface StatusViewSource {
      * its work" are not the same blank space in this view.
      */
     readonly dreamerTickFailure?: DreamerTickFailure | null;
+    readonly dreamerFailures?: readonly { task: string; error: string }[];
     readonly memoryCount: number;
     readonly sessionNoteCount?: number;
     readonly readySmartNoteCount?: number;
@@ -525,9 +527,18 @@ function dreamerUnsupportedRows(source: StatusViewSource): StatusRow[] {
 
 /** One row naming the stage that stopped the last maintenance pass, if one did. */
 function dreamerTickFailureRows(source: StatusViewSource, now: number): StatusRow[] {
+    const quotas = [
+        ...new Set(
+            (source.dreamerFailures ?? []).flatMap((failure) => {
+                const quota = primaryQuotaDiagnostic(failure.error);
+                return quota ? [quota] : [];
+            }),
+        ),
+    ].map((value): StatusRow => ({ label: "Dreamer quota", value, tone: "warning" }));
     const failure = source.dreamerTickFailure;
-    if (!failure) return [];
+    if (!failure) return quotas;
     return [
+        ...quotas,
         {
             label: "Dreamer blocked",
             value: `${failure.stage} failed ${formatRelativeTime(failure.at, now)} (${userFacingFailureCode(

package/src/shared/storage-permissions.test.ts

@@ -0,0 +1,204 @@
+import { afterEach, describe, expect, it } from "bun:test";
+import { randomUUID } from "node:crypto";
+import {
+    chmodSync,
+    lstatSync,
+    mkdirSync,
+    readdirSync,
+    readFileSync,
+    readlinkSync,
+    rmSync,
+    statSync,
+    symlinkSync,
+    writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { rememberGitIdentity } from "../features/magic-context/memory/project-identity-cache";
+import { markAnnouncementSeen } from "./announcement";
+import { getMagicContextStorageDir } from "./data-path";
+import {
+    __resetStoragePrivatePermissionEnforcementForTests,
+    copyStorageFileSync,
+    copyStorageTreeSync,
+    ensureStorageDirectorySync,
+    setStoragePrivatePermissionEnforcement,
+    tightenStorageTreeSync,
+    writeStorageFileAsync,
+    writeStorageFileAtomicSync,
+    writeStorageFileSync,
+} from "./storage-permissions";
+
+const roots: string[] = [];
+
+function entriesBelow(path: string): string[] {
+    const found = [path];
+    const stat = lstatSync(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) return found;
+    for (const entry of readdirSync(path)) found.push(...entriesBelow(join(path, entry)));
+    return found;
+}
+
+function assertPrivateTree(root: string): void {
+    for (const entry of entriesBelow(root)) {
+        const mode = statSync(entry).mode & 0o777;
+        expect(mode & 0o077, `${entry} mode ${mode.toString(8)}`).toBe(0);
+    }
+}
+
+afterEach(() => {
+    __resetStoragePrivatePermissionEnforcementForTests();
+    for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+describe("owner-only storage permissions", () => {
+    it("creates storage directories, ordinary files, and atomic temporaries privately, then tightens old entries", async () => {
+        if (process.platform === "win32") return;
+        const root = join(
+            tmpdir(),
+            "magic-context",
+            `permissions-ts-${process.pid}-${randomUUID()}`,
+        );
+        roots.push(root);
+        const storage = join(root, "cortexkit", "magic-context");
+
+        ensureStorageDirectorySync(storage, true);
+        writeStorageFileSync(join(storage, "last_announced_version"), "0.45.0", {
+            forcePrivate: true,
+        });
+        writeStorageFileAtomicSync(join(storage, "last-update-check.json"), "{}\n", true);
+        const snapshotPath = join(storage, "snapshot.heapsnapshot");
+        await writeStorageFileAsync(snapshotPath, "snapshot", true);
+        expect(statSync(snapshotPath).mode & 0o077).toBe(0);
+        const legacy = join(storage, "project-identities");
+        mkdirSync(legacy, { recursive: true });
+        writeFileSync(join(legacy, "legacy.json"), "{}\n");
+        chmodSync(legacy, 0o755);
+        chmodSync(join(legacy, "legacy.json"), 0o644);
+
+        const result = tightenStorageTreeSync(storage);
+
+        expect(result.failures).toBe(0);
+        expect(result.tightened).toBe(2);
+        assertPrivateTree(storage);
+
+        const copySource = join(root, "copy-source", "context.db");
+        mkdirSync(dirname(copySource), { recursive: true });
+        writeFileSync(copySource, "database fixture");
+        const copyDestination = join(storage, "backup.db");
+        copyStorageFileSync(copySource, copyDestination, true);
+        expect(statSync(copyDestination).mode & 0o077).toBe(0);
+    });
+
+    it("copies cache symlinks without widening the copied tree", () => {
+        if (process.platform === "win32") return;
+        const root = join(tmpdir(), "magic-context", `copy-tree-ts-${process.pid}-${randomUUID()}`);
+        roots.push(root);
+        const source = join(root, "source");
+        const destination = join(root, "data", "cortexkit", "magic-context", "models");
+        mkdirSync(source, { recursive: true });
+        writeFileSync(join(source, "blob"), "weights");
+        symlinkSync("blob", join(source, "snapshot"));
+
+        copyStorageTreeSync(source, destination, true);
+
+        expect(lstatSync(join(destination, "snapshot")).isSymbolicLink()).toBe(true);
+        expect(readlinkSync(join(destination, "snapshot"))).toBe("blob");
+        assertPrivateTree(destination);
+    });
+
+    it("creates state and identity files through their public data-directory writers privately", () => {
+        if (process.platform === "win32") return;
+        const root = join(tmpdir(), "magic-context", `writers-ts-${process.pid}-${randomUUID()}`);
+        roots.push(root);
+        const previous = {
+            testData: process.env.MAGIC_CONTEXT_TEST_DATA_DIR,
+            xdgData: process.env.XDG_DATA_HOME,
+            storage: process.env.MAGIC_CONTEXT_STORAGE_DIR,
+        };
+        process.env.MAGIC_CONTEXT_TEST_DATA_DIR = root;
+        process.env.XDG_DATA_HOME = root;
+        delete process.env.MAGIC_CONTEXT_STORAGE_DIR;
+        setStoragePrivatePermissionEnforcement(true);
+        try {
+            const storage = getMagicContextStorageDir();
+            ensureStorageDirectorySync(storage, true);
+            rememberGitIdentity(join(root, "project"), "git:0123456789abcdef");
+            markAnnouncementSeen("0.45.0");
+            assertPrivateTree(storage);
+        } finally {
+            if (previous.testData === undefined) delete process.env.MAGIC_CONTEXT_TEST_DATA_DIR;
+            else process.env.MAGIC_CONTEXT_TEST_DATA_DIR = previous.testData;
+            if (previous.xdgData === undefined) delete process.env.XDG_DATA_HOME;
+            else process.env.XDG_DATA_HOME = previous.xdgData;
+            if (previous.storage === undefined) delete process.env.MAGIC_CONTEXT_STORAGE_DIR;
+            else process.env.MAGIC_CONTEXT_STORAGE_DIR = previous.storage;
+        }
+    });
+
+    it("keeps storage filesystem creation behind the shared helper", () => {
+        const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "../../../../");
+        const scanRoots = [
+            "packages/plugin/src",
+            "packages/pi-plugin/src",
+            "packages/cli/src",
+            "packages/dashboard/src",
+        ];
+        const directCreate =
+            /(?:\b(?:fs\.)?(?:mkdirSync|mkdir|writeFileSync|writeFile|appendFileSync|appendFile|createWriteStream|copyFileSync|cpSync)\s*\(|\bBun\.write\s*\()/;
+        const directOpenWrite = /\b(?:openSync|open)\s*\([^,]+,\s*["'](?:w|wx|a|ax|as|as\+)/;
+        const offenders: string[] = [];
+        const visit = (absolute: string): void => {
+            for (const entry of readdirSync(absolute, { withFileTypes: true })) {
+                const path = join(absolute, entry.name);
+                if (entry.isDirectory()) {
+                    if (entry.name !== "node_modules" && entry.name !== "dist") visit(path);
+                    continue;
+                }
+                if (
+                    !/\.(?:ts|tsx|js|mjs|cjs)$/.test(entry.name) ||
+                    /(?:\.test|\.spec)\./.test(entry.name)
+                )
+                    continue;
+                const source = readFileSync(path, "utf8");
+                if (
+                    !source.includes("getMagicContextStorageDir") ||
+                    (!directCreate.test(source) && !directOpenWrite.test(source))
+                )
+                    continue;
+                const relative = path.slice(repoRoot.length + 1);
+                // Project .gitignore maintenance is outside the private data directory;
+                // it writes only the shared per-project ignore file.
+                if (relative === "packages/plugin/src/shared/data-path.ts") continue;
+                // This migration command reads the MC store but writes only harness session files.
+                if (relative === "packages/cli/src/commands/migrate.ts") continue;
+                offenders.push(relative);
+            }
+        };
+        for (const root of scanRoots) visit(join(repoRoot, root));
+        for (const relative of [
+            "packages/plugin/scripts/cache-bust-sentinel.ts",
+            "packages/plugin/scripts/transform-latency-sentinel.ts",
+            "packages/plugin/scripts/subagent-failure-sentinel.ts",
+        ]) {
+            const source = readFileSync(join(repoRoot, relative), "utf8");
+            if (
+                source.includes("getMagicContextStorageDir") &&
+                (directCreate.test(source) || directOpenWrite.test(source))
+            ) {
+                offenders.push(relative);
+            }
+        }
+
+        expect(offenders, `direct filesystem creators in storage-aware modules`).toEqual([]);
+    });
+
+    it("keeps shell backups and staging private from their first creation", () => {
+        const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "../../../../");
+        for (const script of ["scripts/restart-window.sh", "scripts/place-ck-mc.sh"]) {
+            const source = readFileSync(join(repoRoot, script), "utf8");
+            expect(source, script).toMatch(/^umask 077$/m);
+        }
+    });
+});

package/src/shared/storage-permissions.ts

@@ -4,6 +4,28 @@
  * Storage is shared by OpenCode and Pi, so all writers consult one setting before
  * applying POSIX modes. The default preserves the historical owner-only policy.
  */
+import { randomBytes } from "node:crypto";
+import type { WriteStream } from "node:fs";
+import {
+    chmodSync,
+    closeSync,
+    createWriteStream,
+    lstatSync,
+    mkdirSync,
+    openSync,
+    readdirSync,
+    readlinkSync,
+    readSync,
+    renameSync,
+    rmSync,
+    symlinkSync,
+    writeFileSync,
+    writeSync,
+} from "node:fs";
+import type { FileHandle } from "node:fs/promises";
+import { open as openAsync, writeFile as writeFileAsync } from "node:fs/promises";
+import { dirname, join } from "node:path";
+
 let enforcePrivateStoragePermissions = true;
 
 export function setStoragePrivatePermissionEnforcement(enforce: boolean): void {
@@ -18,3 +40,173 @@ export function shouldEnforcePrivateStoragePermissions(): boolean {
 export function __resetStoragePrivatePermissionEnforcementForTests(): void {
     enforcePrivateStoragePermissions = true;
 }
+
+/** Create storage directories with owner-only permissions at their creation. */
+export function ensureStorageDirectorySync(
+    directory: string,
+    forcePrivate = false,
+    recursive = true,
+): void {
+    const privateMode = forcePrivate || shouldEnforcePrivateStoragePermissions();
+    mkdirSync(directory, {
+        recursive,
+        ...(privateMode ? { mode: 0o700 } : {}),
+    });
+}
+
+/** Create or replace a storage file using a private mode from the first byte. */
+export function writeStorageFileSync(
+    filePath: string,
+    content: string | Uint8Array,
+    options: { encoding?: BufferEncoding; flag?: string; forcePrivate?: boolean } = {},
+): void {
+    const { forcePrivate = false, ...writeOptions } = options;
+    const privateMode = forcePrivate || shouldEnforcePrivateStoragePermissions();
+    writeFileSync(filePath, content, {
+        ...writeOptions,
+        ...(privateMode ? { mode: 0o600 } : {}),
+    });
+}
+
+/** Write a private sibling then atomically publish it without a permissive temp window. */
+export function writeStorageFileAtomicSync(
+    filePath: string,
+    content: string | Uint8Array,
+    forcePrivate = false,
+): void {
+    ensureStorageDirectorySync(dirname(filePath), forcePrivate);
+    const tempPath = `${filePath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+    try {
+        writeStorageFileSync(tempPath, content, { flag: "wx", forcePrivate });
+        renameSync(tempPath, filePath);
+    } catch (error) {
+        rmSync(tempPath, { force: true });
+        throw error;
+    }
+}
+
+export function copyStorageFileSync(
+    sourcePath: string,
+    destinationPath: string,
+    forcePrivate = false,
+): void {
+    ensureStorageDirectorySync(dirname(destinationPath), forcePrivate);
+    const privateMode = forcePrivate || shouldEnforcePrivateStoragePermissions();
+    const sourceFd = openSync(sourcePath, "r");
+    let destinationFd: number | undefined;
+    try {
+        destinationFd = openSync(destinationPath, "wx", privateMode ? 0o600 : 0o666);
+        const buffer = Buffer.allocUnsafe(1024 * 1024);
+        for (;;) {
+            const bytesRead = readSync(sourceFd, buffer, 0, buffer.length, null);
+            if (bytesRead === 0) break;
+            let offset = 0;
+            while (offset < bytesRead) {
+                offset += writeSync(destinationFd, buffer, offset, bytesRead - offset);
+            }
+        }
+    } catch (error) {
+        if (destinationFd !== undefined) rmSync(destinationPath, { force: true });
+        throw error;
+    } finally {
+        closeSync(sourceFd);
+        if (destinationFd !== undefined) closeSync(destinationFd);
+    }
+}
+
+export function copyStorageTreeSync(
+    sourcePath: string,
+    destinationPath: string,
+    forcePrivate = false,
+): void {
+    const stat = lstatSync(sourcePath);
+    if (stat.isSymbolicLink()) {
+        ensureStorageDirectorySync(dirname(destinationPath), forcePrivate);
+        symlinkSync(readlinkSync(sourcePath), destinationPath);
+        return;
+    }
+    if (!stat.isDirectory()) {
+        copyStorageFileSync(sourcePath, destinationPath, forcePrivate);
+        return;
+    }
+    ensureStorageDirectorySync(destinationPath, forcePrivate);
+    for (const entry of readdirSync(sourcePath)) {
+        copyStorageTreeSync(join(sourcePath, entry), join(destinationPath, entry), forcePrivate);
+    }
+}
+
+export function openStorageFileSync(filePath: string, flags: string, forcePrivate = false): number {
+    ensureStorageDirectorySync(dirname(filePath), forcePrivate);
+    const privateMode = forcePrivate || shouldEnforcePrivateStoragePermissions();
+    return openSync(filePath, flags, privateMode ? 0o600 : 0o666);
+}
+
+export async function writeStorageFileAsync(
+    filePath: string,
+    content: string | Uint8Array,
+    forcePrivate = false,
+): Promise<void> {
+    const privateMode = forcePrivate || shouldEnforcePrivateStoragePermissions();
+    ensureStorageDirectorySync(dirname(filePath), privateMode);
+    await writeFileAsync(filePath, content, privateMode ? { mode: 0o600 } : undefined);
+}
+
+export async function writeStorageFileHandleAsync(
+    handle: FileHandle,
+    content: string,
+): Promise<void> {
+    await handle.writeFile(content);
+}
+
+export function createStorageWriteStream(filePath: string, forcePrivate = false): WriteStream {
+    const privateMode = forcePrivate || shouldEnforcePrivateStoragePermissions();
+    return createWriteStream(filePath, privateMode ? { mode: 0o600 } : undefined);
+}
+
+export async function createStorageFileHandleAsync(
+    filePath: string,
+    flags: string,
+    forcePrivate = false,
+) {
+    const privateMode = forcePrivate || shouldEnforcePrivateStoragePermissions();
+    return openAsync(filePath, flags, privateMode ? 0o600 : undefined);
+}
+
+/** Tighten existing entries during storage startup; symlinks are never followed. */
+export function tightenStorageTreeSync(root: string): { tightened: number; failures: number } {
+    if (!shouldEnforcePrivateStoragePermissions() || process.platform === "win32") {
+        return { tightened: 0, failures: 0 };
+    }
+    let tightened = 0;
+    let failures = 0;
+    const visit = (entryPath: string): void => {
+        let stat: ReturnType<typeof lstatSync>;
+        try {
+            stat = lstatSync(entryPath);
+        } catch {
+            failures++;
+            return;
+        }
+        if (stat.isSymbolicLink()) return;
+        const mode = stat.isDirectory() ? 0o700 : 0o600;
+        if ((stat.mode & 0o077) !== 0 || (stat.mode & 0o777) !== mode) {
+            try {
+                chmodSync(entryPath, mode);
+                tightened++;
+            } catch {
+                failures++;
+            }
+        }
+        if (!stat.isDirectory()) return;
+        let entries: string[];
+        try {
+            entries = readdirSync(entryPath);
+        } catch {
+            failures++;
+            return;
+        }
+        for (const entry of entries) visit(join(entryPath, entry));
+    };
+    visit(root);
+    return { tightened, failures };
+}

package/src/shared/temporal-upgrade-fixture.ts

@@ -0,0 +1,50 @@
+import fixture from "../../../../testdata/temporal-upgrade-projections.json";
+import type { Database } from "./sqlite";
+
+export type TemporalFixtureRuntime = "Pi" | "OpenCode 1" | "OpenCode 2";
+type Value = null | string | number | { base64: string };
+interface CapturedSession {
+    sessionId: string;
+    cwd?: string;
+    input: unknown[];
+    entryIds?: string[];
+    projection: unknown[];
+    projectionJson: string;
+    state: Record<string, Array<Record<string, Value>>>;
+}
+
+export const temporalUpgradeCases: Record<TemporalFixtureRuntime, CapturedSession> = fixture.cases;
+
+/** Restore old served state, never by first rendering it with the current code. */
+export function seedTemporalUpgradeFixture(
+    db: Database,
+    runtime: TemporalFixtureRuntime,
+): CapturedSession {
+    const captured = temporalUpgradeCases[runtime];
+    db.transaction(() => {
+        for (const [table, rows] of Object.entries(captured.state)) {
+            for (const row of rows) {
+                const columns = Object.keys(row);
+                const values = Object.values(row).map((value) =>
+                    value !== null && typeof value === "object"
+                        ? Buffer.from(value.base64, "base64")
+                        : value,
+                );
+                db.prepare(
+                    `INSERT INTO ${table} (${columns.join(",")}) VALUES (${columns.map(() => "?").join(",")})`,
+                ).run(...values);
+            }
+        }
+        // Advance only the cache clock: timestamp-derived marker bytes and
+        // the old input/projection are the immutable captured fixture.
+        db.prepare("UPDATE session_meta SET last_response_time=? WHERE session_id=?").run(
+            Date.now(),
+            captured.sessionId,
+        );
+        db.prepare("UPDATE lkg_slots SET captured_at=? WHERE session_id=?").run(
+            Date.now(),
+            captured.sessionId,
+        );
+    }).immediate();
+    return captured;
+}

package/src/shared/user-facing-codes.ts

@@ -245,6 +245,12 @@ export const USER_FACING_FAILURES = {
         sentence: "Magic Context has no context.db.",
         action: "Run `npx @cortexkit/magic-context doctor store init`, then restart ck-mc.",
     },
+    checkout_claim_held_elsewhere: {
+        code: "MC-C16",
+        sentence:
+            "This request was not sent: this agent is checked out on another machine, so Magic Context will not work on its sessions here.",
+        action: "Move the agent back to this machine, then send your message again.",
+    },
     single_store_migration_required: {
         code: "MC-C14",
         sentence: "Magic Context's Rust mode needs a one-time migration of its store.",

package/src/shared/write-transaction-timing.test.ts

@@ -0,0 +1,39 @@
+import { expect, spyOn, test } from "bun:test";
+import * as logger from "./logger";
+import { logSlowWriteTransaction } from "./write-transaction-timing";
+
+test("slow-write diagnostics distinguish preparation from held rendering and writes", () => {
+    const log = spyOn(logger, "log").mockImplementation(() => {});
+    try {
+        logSlowWriteTransaction("fold", 100, 1000, 1400, {
+            pre_metadata: 1,
+            pre_onFoldPrepare: 200,
+            staleCheck: 5,
+            m1Render: 100,
+            persistCachedM0: 600,
+            sessionMeta: 5,
+            onFoldCommit: 10,
+            commit: 580,
+        });
+        expect(log.mock.calls).toEqual([
+            [
+                "[magic-context] slow write transaction: site=fold held=1300.0ms pre_metadata=1.0ms pre_onFoldPrepare=200.0ms staleCheck=5.0ms m1Render=100.0ms persistCachedM0=600.0ms sessionMeta=5.0ms onFoldCommit=10.0ms commit=580.0ms",
+            ],
+        ]);
+        logSlowWriteTransaction("fast", 100, 1000, 101);
+        expect(log).toHaveBeenCalledTimes(1);
+    } finally {
+        log.mockRestore();
+    }
+});
+
+test("step diagnostics cannot make a committed write appear to fail", () => {
+    const log = spyOn(logger, "log").mockImplementation(() => {
+        throw new Error("logging failed");
+    });
+    try {
+        expect(() => logSlowWriteTransaction("fold", 0, 1000, 2000, { commit: 10 })).not.toThrow();
+    } finally {
+        log.mockRestore();
+    }
+});

package/src/shared/write-transaction-timing.ts

@@ -15,12 +15,36 @@ export function logSlowWriteTransaction(
     startedAt: number,
     thresholdMs = SLOW_WRITE_TRANSACTION_THRESHOLD_MS,
     completedAtMs = performance.now(),
+    steps?: Readonly<Record<string, number>>,
 ): void {
     try {
         const durationMs = completedAtMs - startedAt;
         if (durationMs < thresholdMs) return;
-        log(`[magic-context] slow write transaction: site=${site} held=${durationMs.toFixed(1)}ms`);
+        const detail = steps
+            ? Object.entries(steps)
+                  .map(([name, ms]) => `${name}=${ms.toFixed(1)}ms`)
+                  .join(" ")
+            : "";
+        log(
+            `[magic-context] slow write transaction: site=${site} held=${durationMs.toFixed(1)}ms${detail ? ` ${detail}` : ""}`,
+        );
     } catch {
         // Timing diagnostics must never make a committed write appear to fail.
     }
 }
+
+/** Step durations include precomputation when named `pre_*`; held time never does. */
+export class WriteTransactionSteps {
+    readonly durations: Record<string, number> = {};
+    private last = performance.now();
+
+    mark(name: string): void {
+        const now = performance.now();
+        this.durations[name] = now - this.last;
+        this.last = now;
+    }
+
+    reset(): void {
+        this.last = performance.now();
+    }
+}

package/src/tui/dialogs/status-dialog-render.test.ts

@@ -163,7 +163,7 @@ const LAYOUT_CASES: LayoutCase[] = [
         status: LONG_VALUE_STATUS,
         terminalWidth: 80,
         dialogWidth: 60,
-        expected: ["Configured", "context-preview)", "Execute threshold", "Esc to close"],
+        expected: ["Configured", "your config)", "Execute threshold", "Esc to close"],
         rows: COMPLETE_ROWS,
     },
 ];