mixdog 0.9.123 → 0.9.124

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.123",
+  "version": "0.9.124",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",
@@ -63,7 +63,7 @@
     "test:release-assets": "node --check scripts/verify-release-assets.mjs && node --check scripts/release-gate-test.mjs && node --test scripts/release-gate-test.mjs",
     "test:release-focused": "npm run test:release-critical && npm run test:compact && npm run test:shellhardening && npm run test:tool-contracts && npm run test:session && npm run test:session-transport",
     "test:release-critical": "npm run test:release-assets && npm run smoke:patch && npm run test:providers",
-    "test:session-transport": "node --test scripts/session-transport-test.mjs",
+    "test:session-transport": "node --test scripts/session-transport-test.mjs scripts/daemon-bootstrap-test.mjs",
     "test:session": "node --test scripts/runtime-turn-contract-test.mjs scripts/session-save-fault-store-test.mjs",
     "test:media": "node --test src/runtime/media/store.test.mjs src/runtime/media/renditions.test.mjs src/runtime/media/adapters/codex-image.test.mjs",
     "failures": "node scripts/tool-failures.mjs",

package/src/rules/lead/01-general.md

@@ -10,7 +10,5 @@
 - Ask only for decisions.
 - Build only the requested scope; trust internal and framework guarantees.
 - Mid-task: replacement supersedes; addition folds in; status gets a brief
-  answer while work continues. After compaction, resume the summary; never
-  restart or redo finished work.
-- Final text ends the turn only when done. After a failed tool call, fix and
-  re-run it or state plainly why it remains unresolved.
+  answer while work continues. After compaction, resume the summary.
+- Final text ends the turn only when done.

package/src/rules/shared/01-tool.md

@@ -21,20 +21,27 @@
 - Plan the fewest dependent rounds, then the fewest calls. Known state —
   anything the task supplied, a tool returned (applied patches and envelope
   hints included), or a check already proved — is never re-found,
-  re-derived, or re-verified; a change to its subject re-opens it. Batch
-  calls iff none needs another's output or can change another's
-  inputs/state; otherwise serialize. Before each batch, deduplicate the
-  facets still required by the request, route each once to the cheapest
+  re-derived, or re-verified; a change re-opens only affected evidence and
+  postconditions. Batch calls iff none needs another's output or can change
+  another's inputs/state; otherwise serialize. Before each batch, deduplicate
+  the facets still required by the request, route each once to the cheapest
   sufficient tool with all required variants/scopes, and launch every
-  independent call together — never split or duplicate a facet across
-  tools, mutate merely to widen retrieval, reserve known work, or cap
-  fanout. Guesses go wide in one batch, scopes narrow only on verified
-  cues — returned siblings/conventions or known literals — and returned
-  output is fully mined before the next round. Symbol relations end at
+  independent call, diagnostic, experiment variant, and validation case
+  together in one batch or script — never split or duplicate a facet across
+  tools, mutate merely to widen retrieval, reserve known work, or cap fanout.
+  Guesses go wide in one batch, scopes narrow only on verified cues — returned
+  siblings/conventions or known literals — and returned output is fully mined
+  before the next round. Symbol relations end at
   `code_graph`; values/locations end at the context grep returns; `read`
   covers only what returned spans cannot, as an anchored offset/limit
   window. A conclusive result ends its facet; evidence that determines the
   answer, edit, or deliverable ends retrieval — patch if needed.
+- Converge before opening another round: collect all known failures, make one
+  cohesive correction, then one integrated verification. Passed postconditions
+  stay closed unless affected. Rerun a failed check or command only after a
+  change that can alter its outcome; start a new experiment or dependent round
+  only from evidence produced by the prior result. Else switch route or report
+  it unresolved.
 - If inspection can change evidence or durable state, use read-only means;
   mutate only when the deliverable requires it, first preserving evidence
   at risk. Never mutate merely to clear an obstacle or unexpected state;
@@ -52,9 +59,7 @@
   echoing a claim; changes made through `shell` verify under the same
   one-batch contract — one script proving every postcondition, value-level
   included, never one check per round; a postcondition that did not
-  actually run is unresolved, not passed. Retry only failed envelopes;
-  rerun a failed check only after a change that can alter its outcome —
-  commands alike; else switch route or report it unresolved.
+  actually run is unresolved, not passed. Retry only failed envelopes.
   Hand-authored text is edited only with `apply_patch`; computed artifacts
   (data/reports/derived values) come from `shell` computation, never
   hand-transcribed numbers. Earlier `shell` is only for runtime/state

package/src/runtime/agent/orchestrator/session/agent-loop.mjs

@@ -327,6 +327,8 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         const providerMetadata = resp.providerMetadata && typeof resp.providerMetadata === 'object'
             ? resp.providerMetadata
             : null;
+        const stopReason = resp.stopReason ?? resp.stop_reason ?? null;
+        const terminationReason = resp.terminationReason ?? null;
         // Anthropic native server-tool turns (web search / code execution /
         // native MCP) carry `server_tool_use` + `*_tool_result` blocks that
         // exist ONLY in this ordered verbatim list — they cannot be rebuilt
@@ -358,6 +360,8 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             ...(reasoningItems ? { reasoningItems } : {}),
             ...(reasoningContent ? { reasoningContent } : {}),
             ...(providerMetadata ? { providerMetadata } : {}),
+            ...(stopReason ? { stopReason } : {}),
+            ...(terminationReason ? { terminationReason } : {}),
         }, opts);
         messages.push(message);
         try { opts.onAssistantMessageCommitted?.(message); } catch {}
@@ -832,12 +836,22 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                 };
                 break;
             }
-            if (!hasContent && stopReason === 'refusal') {
+            if (stopReason === 'refusal') {
                 if (_refusalRetryUsed) {
                     process.stderr.write(`[loop] safety-classifier refusal persisted after one context-changing retry (sess=${sessionId || 'unknown'}); ending loop as refusal termination.\n`);
                     break;
                 }
                 _refusalRetryUsed = true;
+                // A provider may emit harmless narration before its safety
+                // classifier terminates the turn. Preserve that partial turn
+                // and its stop reason, but never mistake the non-empty text for
+                // a successful completion.
+                if (hasContent && pushIntermediateAssistantResponse(response)) {
+                    if (!suppressMidTurnText) {
+                        _committedTextParts.push(response.content);
+                        try { opts.onAssistantText?.(response.content); } catch { /* best-effort */ }
+                    }
+                }
                 messages.push({
                     role: 'user',
                     content: '[mixdog-runtime] The previous completion was refused by the provider safety classifier (stopReason=refusal). Do not repeat it. Complete your assigned output within policy by omitting or reframing disallowed content; if no compliant output is possible, briefly state the refusal.',

package/src/runtime/agent/orchestrator/session/manager/ask-session.mjs

@@ -807,6 +807,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                 const persistedAssistantContent = typeof result.historyContent === 'string'
                     ? result.historyContent
                     : (result.content || '');
+                const _terminalStop = result?.stopReason ?? result?.stop_reason ?? null;
                 session.messages.push({
                     role: 'assistant',
                     // Keep content as-is in memory (model-visible). Image bytes,
@@ -820,6 +821,14 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                     ...(result.providerMetadata && typeof result.providerMetadata === 'object'
                         ? { providerMetadata: result.providerMetadata }
                         : {}),
+                    // Keep terminal provider evidence for non-empty turns too.
+                    // A safety classifier can emit narration and then refuse;
+                    // omitting this metadata made that shape indistinguishable
+                    // from an ordinary successful final response.
+                    ...(_terminalStop ? { stopReason: _terminalStop } : {}),
+                    ...(result?.terminationReason ? { terminationReason: result.terminationReason } : {}),
+                    iterations: result?.iterations ?? null,
+                    toolCallsTotal: result?.toolCallsTotal ?? null,
                 });
             } else {
                 // Empty terminal turn: still persist a forensic record so

package/src/runtime/memory/index.mjs

@@ -66,6 +66,7 @@ import { pruneOldEntries } from './lib/memory-maintenance-store.mjs'
 import { computeEntryScore } from './lib/memory-score.mjs'
 import { runFullBackfill } from './lib/memory-ops-policy.mjs'
 import { listCore, addCore, editCore, deleteCore, compactCoreIds, listCoreCandidates, promoteCoreCandidate, dismissCoreCandidate } from './lib/core-memory-store.mjs'
+import { refreshCoreMemoryFile } from './lib/core-memory-file.mjs'
 import { resolveProjectId, resolveProjectScope } from './lib/project-id-resolver.mjs'
 import { openTraceDatabase, closeTraceDatabase, insertTraceEvents, enqueueTraceEvents, insertAgentCalls, registerTraceExitDrain } from './lib/trace-store.mjs'
 import { updateJsonAtomicSync, writeJsonAtomicSync } from '../shared/atomic-file.mjs'
@@ -375,6 +376,17 @@ async function setCycleLastRun(kind, ts) {
   await mergeMetaValue(db, CYCLE_LAST_RUN_KEY, { [kind]: ts })
 }
 
+async function refreshCoreMemorySnapshot(reason = 'mutation') {
+  try {
+    const result = await refreshCoreMemoryFile(db, DATA_DIR)
+    memoryProfile('core-memory:file-refreshed', { reason, revision: result.revision, written: result.written })
+    return result
+  } catch (error) {
+    __mixdogMemoryLog(`[core-memory] file refresh failed (${reason}): ${error?.message || error}\n`)
+    return null
+  }
+}
+
 
 // ── Cycle scheduling cluster (extracted to lib/cycle-scheduler.mjs) ────────
 // The mutually-referential cycle machinery (health ledger, cycle1 outer
@@ -413,6 +425,7 @@ const _cycleScheduler = createCycleScheduler({
   scheduledCycle2Signature,
   scheduledCycle3Signature,
   cycleStateFile: CYCLE_STATE_FILE,
+  onCoreMemoryChanged: refreshCoreMemorySnapshot,
 })
 // Cycle1 run primitives + cycle2 finalize used by MCP action handlers below.
 const _startCycle1Run = _cycleScheduler.startCycle1Run
@@ -444,6 +457,10 @@ async function _initRuntime() {
   const compactStartedAt = performance.now()
   await compactCoreIds(DATA_DIR)
   memoryProfile('core-ids:compact:done', { ms: (performance.now() - compactStartedAt).toFixed(1) })
+  // First boot migrates existing PG core data; later boots reconcile any
+  // crash window between a committed PG mutation and its atomic file refresh.
+  // The snapshot is not part of memory readiness.
+  void refreshCoreMemorySnapshot('boot-migration')
   // Memory module is always-on: the transcript watcher/ingest runs
   // unconditionally except in secondary mode (secondary attaches to a primary's
   // PG and must not double-ingest). The recap toggle only gates whether the
@@ -517,6 +534,7 @@ const _actionHandlers = createMemoryActionHandlers({
   finalizeCycle2Run: _finalizeCycle2Run,
   finalizeCycle3Run: _finalizeCycle3Run,
   requestCycle3Review: _cycleScheduler.requestCycle3Review,
+  refreshCoreMemoryFile: refreshCoreMemorySnapshot,
   getSchedulerCycle1InFlight: () => _cycleScheduler.getCycle1InFlight(),
   getCycle2CallLlm,
   getCycle3CallLlm,

package/src/runtime/memory/lib/core-memory-file.mjs

@@ -0,0 +1,161 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { updateJsonAtomic } from '../../shared/atomic-file.mjs'
+import { resolveProjectScope } from './project-id-resolver.mjs'
+
+export const CORE_MEMORY_FILE_VERSION = 1
+export const CORE_MEMORY_FILE_NAME = 'core-memory.json'
+
+const reservedRevisions = new Map()
+
+function filePath(dataDir) {
+  return join(dataDir, CORE_MEMORY_FILE_NAME)
+}
+
+function finiteNumber(value, fallback = 0) {
+  const number = Number(value)
+  return Number.isFinite(number) ? number : fallback
+}
+
+function normalizeProjectId(value) {
+  if (value == null) return null
+  const text = String(value).trim()
+  return text || null
+}
+
+function normalizeCuratedEntry(row) {
+  const summary = String(row?.summary || '').replace(/\s+/g, ' ').trim()
+  if (!summary) return null
+  return {
+    id: finiteNumber(row?.id),
+    summary,
+    projectId: normalizeProjectId(row?.projectId ?? row?.project_id),
+    updatedAt: finiteNumber(row?.updatedAt ?? row?.updated_at),
+  }
+}
+
+function normalizeGeneratedEntry(row) {
+  const summary = String(row?.summary ?? row?.core_summary ?? '').replace(/\s+/g, ' ').trim()
+  if (!summary) return null
+  return {
+    summary,
+    projectId: normalizeProjectId(row?.projectId ?? row?.project_id),
+    score: finiteNumber(row?.score),
+    lastSeenAt: finiteNumber(row?.lastSeenAt ?? row?.last_seen_at),
+  }
+}
+
+function normalizeSnapshot(snapshot = {}) {
+  return {
+    curated: (Array.isArray(snapshot.curated) ? snapshot.curated : [])
+      .map(normalizeCuratedEntry)
+      .filter(Boolean),
+    generated: (Array.isArray(snapshot.generated) ? snapshot.generated : [])
+      .map(normalizeGeneratedEntry)
+      .filter(Boolean),
+  }
+}
+
+export function readCoreMemoryFile(dataDir) {
+  try {
+    const parsed = JSON.parse(readFileSync(filePath(dataDir), 'utf8'))
+    if (parsed?.version !== CORE_MEMORY_FILE_VERSION) return null
+    const snapshot = normalizeSnapshot(parsed)
+    return {
+      version: CORE_MEMORY_FILE_VERSION,
+      revision: Math.max(0, finiteNumber(parsed.revision)),
+      updatedAt: Math.max(0, finiteNumber(parsed.updatedAt)),
+      ...snapshot,
+    }
+  } catch {
+    return null
+  }
+}
+
+function reserveRevision(dataDir) {
+  const path = filePath(dataDir)
+  const diskRevision = readCoreMemoryFile(dataDir)?.revision || 0
+  const revision = Math.max(diskRevision, reservedRevisions.get(path) || 0) + 1
+  reservedRevisions.set(path, revision)
+  return revision
+}
+
+export async function writeCoreMemoryFileSnapshot(dataDir, snapshot, { revision = reserveRevision(dataDir), now = Date.now() } = {}) {
+  const normalized = normalizeSnapshot(snapshot)
+  const requestedRevision = Math.max(1, finiteNumber(revision, 1))
+  const result = await updateJsonAtomic(filePath(dataDir), (current) => {
+    const currentRevision = Math.max(0, finiteNumber(current?.revision))
+    // A slower refresh may finish after a newer one. Never let its older PG
+    // snapshot overwrite the newer file.
+    if (current?.version === CORE_MEMORY_FILE_VERSION && currentRevision >= requestedRevision) {
+      return undefined
+    }
+    return {
+      version: CORE_MEMORY_FILE_VERSION,
+      revision: requestedRevision,
+      updatedAt: finiteNumber(now, Date.now()),
+      ...normalized,
+    }
+  }, { secret: true, compact: true })
+  return {
+    revision: Math.max(0, finiteNumber(result?.revision)),
+    written: finiteNumber(result?.revision) === requestedRevision,
+  }
+}
+
+export async function refreshCoreMemoryFile(db, dataDir) {
+  // Reserve before querying: if concurrent refreshes complete out of order,
+  // the atomic revision guard rejects the stale result.
+  const revision = reserveRevision(dataDir)
+  const [curatedResult, generatedResult] = await Promise.all([
+    db.query(`
+      SELECT id, summary, project_id, updated_at
+      FROM core_entries
+      WHERE status IS NULL OR status = 'active'
+      ORDER BY project_id NULLS FIRST, id ASC
+    `),
+    db.query(`
+      SELECT core_summary, project_id, score, last_seen_at
+      FROM (
+        SELECT core_summary, project_id, score, last_seen_at,
+               ROW_NUMBER() OVER (
+                 PARTITION BY project_id
+                 ORDER BY score DESC, last_seen_at DESC
+               ) AS scope_rank
+        FROM entries
+        WHERE is_root = 1
+          AND status = 'active'
+          AND core_summary IS NOT NULL
+      ) ranked
+      WHERE scope_rank <= 40
+      ORDER BY project_id NULLS FIRST, scope_rank ASC
+    `),
+  ])
+  return await writeCoreMemoryFileSnapshot(dataDir, {
+    curated: curatedResult?.rows || [],
+    generated: generatedResult?.rows || [],
+  }, { revision })
+}
+
+export function readSessionCoreMemoryPayload(dataDir, cwd) {
+  const file = readCoreMemoryFile(dataDir)
+  if (!file) return null
+  const projectId = resolveProjectScope(typeof cwd === 'string' && cwd ? cwd : null)
+  const inScope = (entry) => entry.projectId === null || entry.projectId === projectId
+  const curated = file.curated
+    .filter(inScope)
+    .sort((a, b) => {
+      if (a.projectId === null && b.projectId !== null) return -1
+      if (a.projectId !== null && b.projectId === null) return 1
+      return a.id - b.id
+    })
+  const generated = file.generated
+    .filter(inScope)
+    .sort((a, b) => b.score - a.score || b.lastSeenAt - a.lastSeenAt)
+  return {
+    projectId,
+    revision: file.revision,
+    userLines: curated.map((entry) => entry.summary),
+    dbLines: generated.map((entry) => entry.summary),
+  }
+}

package/src/runtime/memory/lib/cycle-scheduler.mjs

@@ -69,6 +69,7 @@ export function createCycleScheduler(deps) {
     scheduledCycle2Signature,
     scheduledCycle3Signature,
     cycleStateFile,
+    onCoreMemoryChanged = async () => {},
   } = deps
 
   // ── Cycle health state ────────────────────────────────────────────────────
@@ -342,6 +343,7 @@ export function createCycleScheduler(deps) {
             if (result?.error) { markCycleDone('cycle3', false, result.error); return }
             await setCycleLastRun('cycle3', Date.now())
             markCycleDone('cycle3', true)
+            await onCoreMemoryChanged('cycle3')
           },
         }
         if (typeof c3Options?.callLlm !== 'function') {
@@ -382,6 +384,7 @@ export function createCycleScheduler(deps) {
       await setCycleLastRun('cycle2_last_error', '')
       log('[cycle2] completed\n')
       markCycleDone('cycle2', true)
+      await onCoreMemoryChanged('cycle2')
     } else {
       const err = gateFailed ? 'gate_failed' : (result.error || 'unknown error')
       await setCycleLastRun('cycle2_last_error', err)
@@ -566,6 +569,7 @@ export function createCycleScheduler(deps) {
       if (result.error) { markCycleDone('cycle3', false, result.error); return }
       await setCycleLastRun('cycle3', Date.now())
       markCycleDone('cycle3', true)
+      await onCoreMemoryChanged('cycle3')
     },
     requestCycle3Review,
     periodicCycle1Config,

package/src/runtime/memory/lib/memory-action-handlers.mjs

@@ -62,6 +62,7 @@ export function createMemoryActionHandlers({
   cwdFromTranscriptPath,
   addCoreImpl = addCore,
   editCoreImpl = editCore,
+  refreshCoreMemoryFile = async () => {},
 }) {
   const DATA_DIR = dataDir
 
@@ -645,6 +646,7 @@ export function createMemoryActionHandlers({
           }
           if (op === 'promote') {
             const entry = await promoteCoreCandidate(coreDataDir, args.id, { ...args, scope })
+            await refreshCoreMemoryFile('core-promote')
             await queueCoreReview('core-promote')
             const mergeNote = entry.merged_with ? ` (merged into core id=${entry.merged_with}, sim=${entry.sim})` : ''
             return { text: `core promoted candidate id=${args.id} → core id=${entry.id}${mergeNote}: ${entry.element}` }
@@ -724,16 +726,19 @@ export function createMemoryActionHandlers({
         }
         if (op === 'add') {
           const entry = await addCoreImpl(coreDataDir, args, projectId)
+          await refreshCoreMemoryFile('core-add')
           await queueCoreReview('core-add')
           return { text: `core added (id=${entry.id}): ${entry.element} — ${entry.summary.slice(0, 200)}` }
         }
         if (op === 'edit') {
           const entry = await editCoreImpl(coreDataDir, args.id, args)
+          await refreshCoreMemoryFile('core-edit')
           await queueCoreReview('core-edit')
           return { text: `core edited (id=${entry.id}): ${entry.element} — ${entry.summary.slice(0, 200)}` }
         }
         if (op === 'delete') {
           const removed = await deleteCore(coreDataDir, args.id)
+          await refreshCoreMemoryFile('core-delete')
           return { text: `core deleted (id=${removed.id}): ${removed.element}` }
         }
       } catch (e) {

package/src/session-runtime/cwd-plugins.mjs

@@ -1,5 +1,6 @@
 import { discoverPluginMcp } from './plugin-mcp.mjs';
 import { featureEnvOverride, memoryToolsEnabled } from './config-helpers.mjs';
+import { readSessionCoreMemoryPayload } from '../runtime/memory/lib/core-memory-file.mjs';
 
 // cwd-plugins.mjs — cwd resolution/apply + plugins-status + core-memory context,
 // extracted from mixdog-session-runtime.mjs. Dependency-injected factory that
@@ -244,33 +245,27 @@ export function createCwdPlugins({
       bootProfile('core-memory:disabled');
       return '';
     }
-    // Explicit opt-out (MIXDOG_BOOT_CORE_MEMORY=0/false/no/off) skips the
-    // memory/PG startup cost; recall and memory tools still initialize the
-    // memory service on first use.
+    // Explicit opt-out (MIXDOG_BOOT_CORE_MEMORY=0/false/no/off) skips this
+    // file-backed prompt block. Recall and memory tools remain available.
     const bootFlag = String(process.env.MIXDOG_BOOT_CORE_MEMORY ?? '').trim().toLowerCase();
     if (bootFlag === '0' || bootFlag === 'false' || bootFlag === 'no' || bootFlag === 'off') {
       bootProfile('core-memory:skipped');
       return '';
     }
     const startedAt = performance.now();
-    let timer = null;
-    const timeout = new Promise((resolveTimeout) => {
-      timer = setTimeout(() => resolveTimeout(''), 2000);
-      timer.unref?.();
-    });
     try {
-      return await Promise.race([
-        (async () => {
-          const memoryMod = await getMemoryModule();
-          if (typeof memoryMod?.buildSessionCoreMemoryPayload !== 'function') return '';
-          return formatCoreMemoryLines(await memoryMod.buildSessionCoreMemoryPayload(getCurrentCwd()));
-        })(),
-        timeout,
-      ]);
+      // The prompt path never starts or waits for PG/embedding/IPC. Memory
+      // runtime maintains this atomic snapshot independently.
+      const dataDir = process.env.MIXDOG_DATA_DIR || cfgMod.getPluginData?.() || STANDALONE_DATA_DIR;
+      const payload = readSessionCoreMemoryPayload(dataDir, getCurrentCwd());
+      if (!payload) {
+        bootProfile('core-memory:file-missing');
+        return '';
+      }
+      return formatCoreMemoryLines(payload);
     } catch {
       return '';
     } finally {
-      if (timer) clearTimeout(timer);
       bootProfile('core-memory:done', { ms: (performance.now() - startedAt).toFixed(1) });
     }
   }

package/src/standalone/channel-transport.mjs

@@ -55,6 +55,7 @@ export function createChannelTransport({
   remoteStatePath = null,
   remoteIntentPath = null,
   onClientRegistered = null,
+  onRemoteOwnerStateChange = null,
   agentBroker = null,
 } = {}) {
   if (typeof handleCall !== 'function') throw new Error('handleCall is required');
@@ -243,7 +244,6 @@ export function createChannelTransport({
   }
 
   function publishRemoteOwnerState() {
-    if (!resolvedRemoteStatePath) return;
     const owner = pointerToken ? clients.get(pointerToken) : null;
     const sessionId = String(owner?.remoteSessionId || '');
     const state = {
@@ -263,6 +263,11 @@ export function createChannelTransport({
     ]);
     if (signature === remoteStateSignature) return;
     remoteStateSignature = signature;
+    if (typeof onRemoteOwnerStateChange === 'function') {
+      try { onRemoteOwnerStateChange(state); }
+      catch (err) { log(`remote owner state listener failed: ${err?.message || err}`); }
+    }
+    if (!resolvedRemoteStatePath) return;
     try {
       writeJsonAtomicSync(resolvedRemoteStatePath, state, { compact: true });
     } catch (err) {

package/src/standalone/daemon.mjs

@@ -243,6 +243,7 @@ let sessionRuntimePool = null;
 let localSessionBridge = null;
 let memoryRuntime = null;
 let agentDispatchBroker = null;
+let remoteOwnerState = { enabled: false, sessionId: null };
 let shuttingDown = false;
 let shutdownRecheckTimer = null;
 let replacementRequested = null;
@@ -250,6 +251,27 @@ const eventLoopDelay = monitorEventLoopDelay({ resolution: 20 });
 eventLoopDelay.enable();
 let eventLoopLagTimer = null;
 
+function startMemoryRuntimeEarly() {
+  // Start the isolated memory process immediately after singleton ownership is
+  // established. Do not await it: daemon front-door readiness remains
+  // independent while PG/embedding cold-start overlaps all other boot work.
+  if (process.env.MIXDOG_DAEMON_SKIP_MEMORY === '1') {
+    log('memory runtime skipped (MIXDOG_DAEMON_SKIP_MEMORY=1)');
+    return;
+  }
+  if (memoryRuntime) return;
+  try {
+    memoryRuntime = getStandaloneMemoryRuntime({
+      entry: MEMORY_ENTRY,
+      dataDir: DATA_DIR,
+      cwd: CWD,
+    });
+    void memoryRuntime.init()
+      .then(() => log('memory runtime ready in isolated process'))
+      .catch((e) => log(`memory.start failed (non-fatal): ${e?.message || e}`));
+  } catch (e) { log(`memory.start setup failed (non-fatal): ${e?.message || e}`); }
+}
+
 function eventLoopStatus() {
   const milliseconds = (value) => Number.isFinite(value) ? Math.round(value / 1e6) : 0;
   return {
@@ -387,6 +409,7 @@ async function main() {
     process.exit(0);
   }
   process.on('exit', () => { try { releaseSingletonOwner(OWNER_PATH, process.pid); } catch {} });
+  startMemoryRuntimeEarly();
   agentDispatchBroker = createAgentDispatchBroker({
     loadConfig: loadAgentConfig,
     initProviders,
@@ -458,6 +481,17 @@ async function main() {
     onClientsEmpty: () => { maybeSelfShutdown('no live channel clients'); },
     // First channels client in: bring the channels runtime up (see startChannels).
     onClientRegistered: () => { startChannels(); },
+    onRemoteOwnerStateChange: (state) => {
+      remoteOwnerState = {
+        enabled: state?.enabled === true,
+        sessionId: state?.enabled === true && state?.sessionId
+          ? String(state.sessionId)
+          : null,
+      };
+      const frame = { type: 'remote-owner-state', ...remoteOwnerState };
+      localSessionBridge?.publish(frame);
+      sessionTransport?.broadcast(frame);
+    },
   });
   setChannelNotifySink((method, params) => transport.notify(method, params));
   const { port, token } = await transport.start();
@@ -571,6 +605,7 @@ async function main() {
         refreshFromStorage: options.refreshFromStorage === true,
       });
     },
+    getRemoteOwnerState: () => remoteOwnerState,
     desktopRuntime,
     onFrame: (frame, targetTokens) => {
       localSessionBridge?.publish(frame, targetTokens);
@@ -681,27 +716,6 @@ async function main() {
   // client — see the transport's onClientRegistered hook.
   if (process.env.MIXDOG_DAEMON_SPAWNED_FOR !== 'session') startChannels();
 
-  // Memory owns a separate process/event loop. Initialization stays
-  // asynchronous because DB/embedding startup must not delay the front-door
-  // ready handshake. The proxy retains it for this daemon pid and its
-  // client-grace lifecycle reaps it only after the daemon is gone.
-  // Isolated test roots opt out (MIXDOG_DAEMON_SKIP_MEMORY=1): spinning a
-  // throwaway Postgres cluster per test run is pure cost, and a hard-killed
-  // daemon would orphan it.
-  if (process.env.MIXDOG_DAEMON_SKIP_MEMORY === '1') {
-    log('memory runtime skipped (MIXDOG_DAEMON_SKIP_MEMORY=1)');
-    return;
-  }
-  try {
-    memoryRuntime = getStandaloneMemoryRuntime({
-      entry: MEMORY_ENTRY,
-      dataDir: DATA_DIR,
-      cwd: CWD,
-    });
-    void memoryRuntime.init()
-      .then(() => log('memory runtime ready in isolated process'))
-      .catch((e) => log(`memory.start failed (non-fatal): ${e?.message || e}`));
-  } catch (e) { log(`memory.start setup failed (non-fatal): ${e?.message || e}`); }
 }
 
 process.on('SIGTERM', () => { void shutdown('SIGTERM'); });

package/src/standalone/session-client.mjs

@@ -24,6 +24,7 @@ import {
   SESSION_READ_ACTIONS,
   SESSION_READ_ACTION_SET,
 } from './session-protocol.mjs';
+import { readSingletonOwner } from '../runtime/shared/singleton-owner.mjs';
 
 function runtimeRoot() {
   return process.env.MIXDOG_RUNTIME_ROOT
@@ -35,6 +36,13 @@ export function sessionDiscoveryPath() {
   return path.join(runtimeRoot(), 'daemon.json');
 }
 
+function daemonOwnerPath() {
+  const dataDir = process.env.MIXDOG_DATA_DIR
+    ? path.resolve(process.env.MIXDOG_DATA_DIR)
+    : path.join(process.env.MIXDOG_HOME || path.join(os.homedir(), '.mixdog'), 'data');
+  return path.join(dataDir, 'daemon-owner.json');
+}
+
 function daemonEntry() {
   // ONE daemon: the channels/memory host also owns the session pool, so both
   // spawn paths converge on the same singleton process.
@@ -61,13 +69,14 @@ const URGENT_CALLS = new Set([
   'desktop.control',
   'desktop.unsubscribe',
 ]);
-const EVENT_STREAM_RECONNECT_BASE_MS = 100;
-const EVENT_STREAM_RECONNECT_MAX_MS = 1_000;
-const EVENT_STREAM_HEALTH_GRACE_MS = 750;
+const EVENT_STREAM_RECONNECT_BASE_MS = 1_000;
+const EVENT_STREAM_RECONNECT_MAX_MS = 30_000;
 // Claude Code transport parity: keepalive silence is detected independently
 // from TCP close, and a continuously failing reconnect storm is bounded.
 const EVENT_STREAM_LIVENESS_TIMEOUT_MS = 45_000;
 const EVENT_STREAM_RECONNECT_BUDGET_MS = 10 * 60_000;
+const DEFAULT_DAEMON_READY_TIMEOUT_MS = 15_000;
+const DAEMON_OWNER_POLL_MS = 50;
 // A daemon that restarted needs a moment to rebind its port, so one immediate
 // re-attach often lands in the same gap the first call died in. Mirror the
 // event-stream policy above with a short bounded ladder; `callId` keeps a
@@ -127,17 +136,20 @@ export async function probeSessionHealth({ port, token, timeoutMs = 800 } = {})
   } catch { return null; }
 }
 
+function isPidAlive(pid) {
+  const value = Number(pid);
+  if (!Number.isInteger(value) || value <= 0) return false;
+  try { process.kill(value, 0); return true; }
+  catch (error) { return error?.code === 'EPERM'; }
+}
+
 export function readSessionDiscovery(discoveryPath = sessionDiscoveryPath()) {
-  const pidAlive = (pid) => {
-    try { process.kill(Number(pid), 0); return true; }
-    catch (error) { return error?.code === 'EPERM'; }
-  };
   const readUnified = (candidate) => {
     const parsed = JSON.parse(readFileSync(candidate, 'utf8'));
     const endpoint = parsed?.endpoints?.session;
     const channel = parsed?.endpoints?.channel;
     const pid = parsed?.pid;
-    if (!endpoint?.port || !endpoint?.token || !pid || !pidAlive(pid)) return null;
+    if (!endpoint?.port || !endpoint?.token || !pid || !isPidAlive(pid)) return null;
     return {
       ...endpoint,
       pid,
@@ -229,19 +241,29 @@ async function replaceLowerDaemon(discovery, initialHealth, { log }) {
 /** Fork one daemon candidate DETACHED (it outlives this client — machine
  *  global) and resolve when it reports ready OR exits (race loss/crash); the
  *  caller then re-reads discovery and attaches to whoever won. */
-function spawnDaemonCandidate({ cwd, log }) {
+function spawnDaemonCandidate({ cwd, log, timeoutMs = 30_000 }) {
   return new Promise((resolve) => {
     let settled = false;
-    const done = () => { if (!settled) { settled = true; resolve(); } };
+    let timer = null;
+    const done = () => {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      resolve();
+    };
     let child;
     try {
       child = fork(daemonEntry(), [], {
         cwd,
         stdio: ['ignore', 'ignore', 'pipe', 'ipc'],
-        detached: process.platform !== 'win32',
+        // The machine-global daemon must not share Electron's Windows process
+        // lifetime. A GPU/Crashpad failure in the desktop must leave this Node
+        // host and every live session untouched.
+        detached: true,
         windowsHide: true,
         env: {
           ...process.env,
+          ELECTRON_RUN_AS_NODE: '1',
           MIXDOG_DAEMON_HOST: '1',
           // Session-only spawn: the daemon stays dormant on the channels side
           // until a channels client registers.
@@ -269,14 +291,32 @@ function spawnDaemonCandidate({ cwd, log }) {
     });
     child.once('exit', done);
     child.once('error', (err) => { log(`daemon spawn error: ${err?.message || err}`); done(); });
-    const timer = setTimeout(done, 30_000);
+    timer = setTimeout(done, Math.max(1, timeoutMs));
     timer.unref?.();
   });
 }
 
 /** Spawn-or-attach discovery for the machine-global daemon. */
-export async function ensureDaemon({ cwd = process.cwd(), log = () => {}, attempts = 5 } = {}) {
-  for (let attempt = 0; attempt < attempts; attempt += 1) {
+export async function ensureDaemon({
+  cwd = process.cwd(),
+  log = () => {},
+  attempts = 5,
+  readyTimeoutMs = null,
+} = {}) {
+  const configuredTimeoutMs = Number(process.env.MIXDOG_DAEMON_READY_TIMEOUT_MS);
+  const timeoutMs = Math.max(
+    1,
+    Number.isFinite(Number(readyTimeoutMs)) && Number(readyTimeoutMs) > 0
+      ? Number(readyTimeoutMs)
+      : configuredTimeoutMs > 0
+        ? configuredTimeoutMs
+        : DEFAULT_DAEMON_READY_TIMEOUT_MS,
+  );
+  const deadline = Date.now() + timeoutMs;
+  const maxSpawnAttempts = Math.max(0, Math.floor(Number(attempts) || 0));
+  let spawnAttempts = 0;
+  let waitingOwnerPid = 0;
+  while (Date.now() < deadline) {
     const discovery = readSessionDiscovery();
     if (discovery) {
       const health = await probeSessionHealth({ port: discovery.port, token: discovery.token });
@@ -294,8 +334,27 @@ export async function ensureDaemon({ cwd = process.cwd(), log = () => {}, attemp
         throw err;
       }
     }
-    await spawnDaemonCandidate({ cwd, log });
-    await delay(100);
+    // A concurrent launcher can win the owner lock before it publishes
+    // daemon.json. That is a healthy singleton boot, not a reason to spawn five
+    // doomed contenders and report "endpoint unavailable" after ~500 ms.
+    const ownerState = readSingletonOwner(daemonOwnerPath());
+    const ownerPid = ownerState.alive ? Number(ownerState.owner?.pid) || 0 : 0;
+    if (ownerPid) {
+      if (ownerPid !== waitingOwnerPid) {
+        waitingOwnerPid = ownerPid;
+        log(`waiting for daemon owner pid=${ownerPid} to publish its session endpoint`);
+      }
+      await delay(Math.min(DAEMON_OWNER_POLL_MS, Math.max(1, deadline - Date.now())));
+      continue;
+    }
+    waitingOwnerPid = 0;
+    if (spawnAttempts >= maxSpawnAttempts) break;
+    spawnAttempts += 1;
+    await spawnDaemonCandidate({
+      cwd,
+      log,
+      timeoutMs: Math.max(1, deadline - Date.now()),
+    });
   }
   throw new Error('daemon session endpoint is unavailable');
 }
@@ -314,7 +373,6 @@ export async function attachSession({
   onStreamReconnect = () => {},
   streamReconnectBaseMs = EVENT_STREAM_RECONNECT_BASE_MS,
   streamReconnectMaxMs = EVENT_STREAM_RECONNECT_MAX_MS,
-  streamReconnectHealthGraceMs = EVENT_STREAM_HEALTH_GRACE_MS,
   streamLivenessTimeoutMs = EVENT_STREAM_LIVENESS_TIMEOUT_MS,
   streamReconnectBudgetMs = EVENT_STREAM_RECONNECT_BUDGET_MS,
   log = () => {},
@@ -364,10 +422,6 @@ export async function attachSession({
     reconnectBaseMs,
     Number(streamReconnectMaxMs) || EVENT_STREAM_RECONNECT_MAX_MS,
   );
-  const healthGraceMs = Math.max(
-    reconnectBaseMs,
-    Number(streamReconnectHealthGraceMs) || EVENT_STREAM_HEALTH_GRACE_MS,
-  );
   const livenessMs = Math.max(
     1,
     Number(streamLivenessTimeoutMs) || EVENT_STREAM_LIVENESS_TIMEOUT_MS,
@@ -426,15 +480,40 @@ export async function attachSession({
           signalFatal(`${lastLossReason}; reconnect budget exhausted after ${downtimeMs}ms`);
           return;
         }
-        if (downtimeMs >= healthGraceMs) {
-          const health = await probeSessionHealth({ port, token: serverToken, timeoutMs: 500 });
-          if (!health || Number(health.pid) !== Number(discovery.pid)) {
-            signalFatal(`${lastLossReason}; daemon unavailable or replaced`);
+        const current = readSessionDiscovery();
+        const replaced = current
+          && (
+            Number(current.pid) !== Number(discovery.pid)
+            || Number(current.port) !== Number(port)
+            || String(current.token || '') !== String(serverToken)
+          );
+        if (replaced) {
+          const health = await probeSessionHealth({
+            port: current.port,
+            token: current.token,
+            timeoutMs: 800,
+          });
+          if (health && Number(health.pid) === Number(current.pid)) {
+            signalFatal(
+              `${lastLossReason}; daemon replaced`
+              + ` oldPid=${Number(discovery.pid)} oldPort=${Number(port)}`
+              + ` newPid=${Number(current.pid)} newPort=${Number(current.port)}`,
+            );
             return;
           }
         }
+        if (!isPidAlive(discovery.pid)) {
+          signalFatal(
+            `${lastLossReason}; daemon exited`
+            + ` pid=${Number(discovery.pid)} port=${Number(port)}`,
+          );
+          return;
+        }
+        openStream();
+      })().catch((error) => {
+        log(`session event stream recovery probe failed: ${error?.message || error}`);
         openStream();
-      })().catch(() => signalFatal(`${lastLossReason}; daemon health check failed`));
+      });
     }, delayMs);
     reconnectTimer.unref?.();
   }

package/src/standalone/session-service.mjs

@@ -98,6 +98,7 @@ export function createSessionService({
   sessionExists = null,
   readStoredSession = null,
   listSessions = null,
+  getRemoteOwnerState = null,
   desktopRuntime = null,
   publishIntervalMs = 16,
   onFrame = () => {},
@@ -721,7 +722,13 @@ export function createSessionService({
       throw new Error('session catalog is unavailable');
     }
     const sessions = await listSessions(options || {});
-    return { sessions: sanitizeForWire(Array.isArray(sessions) ? sessions : []) };
+    const remoteOwner = typeof getRemoteOwnerState === 'function'
+      ? await getRemoteOwnerState()
+      : null;
+    return {
+      sessions: sanitizeForWire(Array.isArray(sessions) ? sessions : []),
+      remoteOwner: sanitizeForWire(remoteOwner) ?? null,
+    };
   }
 
   async function loadProjectStore() {

package/src/tui/app/transcript-window.mjs

@@ -177,9 +177,7 @@ export function resolveAnchorScrollOffset({ anchor, items, curPrefix, totalRows,
     if (list[i] && list[i].id === anchor.id) { idx = i; break; }
   }
   if (idx < 0 || idx > curPrefix.length - 2) return null;
-  const itemHeight = Math.max(0, transcriptRowAt(curPrefix, idx + 1) - transcriptRowAt(curPrefix, idx));
-  const clampedOffset = Math.max(0, Math.min(Number(anchor.offset) || 0, itemHeight));
-  const anchorRowCur = transcriptRowAt(curPrefix, idx) + clampedOffset;
+  const anchorRowCur = transcriptRowAt(curPrefix, idx) + (Number(anchor.offset) || 0);
   return Math.max(0, Math.min(maxRows, totalRows - viewRows - anchorRowCur));
 }
 

package/src/tui/components/prompt-input/escape-policy.mjs

@@ -2,15 +2,16 @@ export const PROMPT_ESCAPE_CLEAR_WINDOW_MS = 800;
 export const PROMPT_ESCAPE_HINT_TIMEOUT_MS = 1000;
 
 /**
- * Claude Code-compatible chat Escape priority after overlays/selections have
- * already had a chance to consume the key:
- * active turn -> interrupt immediately, then (while idle) queued editable
- * messages -> restore for editing, idle non-empty draft -> double-press clear,
- * idle empty draft with history -> double-press message selector, otherwise
- * fallback.
+ * Claude Code-compatible chat Escape priority after overlays have already had
+ * a chance to consume the key:
+ * active turn -> interrupt immediately, selected draft -> collapse selection,
+ * then (while idle) queued editable messages -> restore for editing, idle
+ * non-empty draft -> double-press clear, idle empty draft with history ->
+ * double-press message selector, otherwise fallback.
  */
 export function classifyPromptEscape({
   interruptActive = false,
+  hasSelection = false,
   hasQueuedMessages = false,
   hasMessages = false,
   value = '',
@@ -18,6 +19,7 @@ export function classifyPromptEscape({
   now = Date.now(),
 } = {}) {
   if (interruptActive) return { action: 'interrupt', nextClearPressAt: 0 };
+  if (hasSelection) return { action: 'collapse-selection', nextClearPressAt: 0 };
   if (hasQueuedMessages) return { action: 'restore-queue', nextClearPressAt: 0 };
 
   const current = Number(now);

package/src/tui/dist/index.mjs

@@ -6113,6 +6113,7 @@ var PROMPT_ESCAPE_CLEAR_WINDOW_MS = 800;
 var PROMPT_ESCAPE_HINT_TIMEOUT_MS = 1e3;
 function classifyPromptEscape({
   interruptActive = false,
+  hasSelection = false,
   hasQueuedMessages = false,
   hasMessages = false,
   value = "",
@@ -6120,6 +6121,7 @@ function classifyPromptEscape({
   now = Date.now()
 } = {}) {
   if (interruptActive) return { action: "interrupt", nextClearPressAt: 0 };
+  if (hasSelection) return { action: "collapse-selection", nextClearPressAt: 0 };
   if (hasQueuedMessages) return { action: "restore-queue", nextClearPressAt: 0 };
   const current = Number(now);
   const previous = Number(lastClearPressAt);
@@ -11697,9 +11699,7 @@ function resolveAnchorScrollOffset({ anchor, items, curPrefix, totalRows, viewRo
     }
   }
   if (idx < 0 || idx > curPrefix.length - 2) return null;
-  const itemHeight = Math.max(0, transcriptRowAt(curPrefix, idx + 1) - transcriptRowAt(curPrefix, idx));
-  const clampedOffset = Math.max(0, Math.min(Number(anchor.offset) || 0, itemHeight));
-  const anchorRowCur = transcriptRowAt(curPrefix, idx) + clampedOffset;
+  const anchorRowCur = transcriptRowAt(curPrefix, idx) + (Number(anchor.offset) || 0);
   return Math.max(0, Math.min(maxRows, totalRows - viewRows - anchorRowCur));
 }
 function fnv1a32(str) {