mixdog 0.9.142 → 0.9.143

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.142",
+  "version": "0.9.143",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",

package/scripts/agent-lead-e2e-probe.mjs

@@ -15,12 +15,7 @@ import { homedir, tmpdir } from 'node:os';
 import { join } from 'node:path';
 
 const ROOT = mkdtempSync(join(tmpdir(), 'mixdog-lead-e2e-'));
-// MIXDOG_LEAD_E2E_LIVE_DAEMON=1: keep the inherited runtime root (live daemon
-// discovery) and opt into agent shard spread, so the spawned worker runs on
-// the INSTALLED daemon's shard pool — the deployed remote-completion path.
-const LIVE_DAEMON = process.env.MIXDOG_LEAD_E2E_LIVE_DAEMON === '1';
-if (LIVE_DAEMON) process.env.MIXDOG_AGENT_SHARD_SPREAD = '1';
-else process.env.MIXDOG_RUNTIME_ROOT = ROOT;
+process.env.MIXDOG_RUNTIME_ROOT = ROOT;
 process.env.MIXDOG_BOOT_CORE_MEMORY = '0';
 process.env.MIXDOG_DAEMON_SKIP_MEMORY = '1';
 process.env.MIXDOG_FEATURE_MEMORY = '0';

package/scripts/agent-turn-trace-probe.mjs

@@ -17,9 +17,7 @@ const ROOT = mkdtempSync(join(tmpdir(), 'mixdog-turn-trace-'));
 process.env.MIXDOG_RUNTIME_ROOT = ROOT;
 process.env.MIXDOG_DAEMON_SKIP_MEMORY = '1';
 process.env.MIXDOG_BOOT_CORE_MEMORY = '0';
-process.env.MIXDOG_AGENT_SHARD_SPREAD = '1';
-// The probe's whole point is the trace: explicit path (shared by daemon and
-// shard children via env inheritance) + timing rows.
+// The probe's whole point is the trace: explicit path plus timing rows.
 const TRACE_PATH = join(ROOT, 'agent-trace.jsonl');
 delete process.env.MIXDOG_AGENT_TRACE_DISABLE;
 process.env.MIXDOG_AGENT_TRACE_PATH = TRACE_PATH;
@@ -75,7 +73,7 @@ try {
       '2) read README.md (first 40 lines)',
       '3) run the shell command: node -v',
       '4) read apps/desktop/package.json',
-      '5) grep the string "createSessionRuntimePool" under src/standalone (files list only)',
+      '5) grep the string "createSessionRuntimeHost" under src/standalone (files list only)',
       'Then reply with one line: DONE <package name> <node version>. Do not edit anything.',
     ].join('\n'),
   }, { invocationSource: 'model-tool', cwd: REPO });
@@ -90,7 +88,7 @@ try {
   process.stdout.write(`wall=${((Date.now() - t0) / 1000).toFixed(1)}s\n--- result ---\n${last.slice(0, 400)}\n`);
   try { agent.closeAll('turn-trace probe end'); } catch { /* teardown */ }
 
-  // Shard children flush their local trace buffers on a short timer.
+  // The runtime worker flushes its local trace buffer on a short timer.
   await sleep(9_000);
   const rows = existsSync(TRACE_PATH)
     ? readFileSync(TRACE_PATH, 'utf8').split('\n').filter(Boolean).flatMap((line) => {

package/src/runtime/agent/orchestrator/agent-runtime/agent-dispatch.mjs

@@ -334,45 +334,6 @@ export function makeAgentDispatch(opts = {}) {
         // pooled or resumed. Cache prefix matching happens at the provider
         // layer (account-level), not the session level.
         const finalPrompt = prompt;
-        // Agent shard spread: inside a shard child the ephemeral hidden-role
-        // session runs on a peer shard through the daemon session protocol —
-        // the same single spawn path the agent tool uses. ONE path per mode:
-        // a remote failure fails the dispatch (no in-process fallback).
-        const spreadMod = await import('../../../../standalone/agent-tool/shard-spread.mjs')
-            .catch(() => null);
-        if (spreadMod?.agentShardSpreadEnabled?.()) {
-            const raw = await spreadMod.dispatchHiddenAgentRemote({
-                spec: {
-                    agent,
-                    presetName,
-                    preset,
-                    runtimeSpec,
-                    permission,
-                    cwd,
-                    sourceType: opts.sourceType,
-                    sourceName: sourceNameArg || opts.sourceName,
-                    parentSessionId: opts.parentSessionId || null,
-                    ownerSessionId: opts.ownerSessionId === undefined ? (opts.parentSessionId || null) : opts.ownerSessionId,
-                    clientHostPid: opts.clientHostPid,
-                    skipRoleReminder: isPoolC,
-                    schemaAllowedTools: resolveHiddenRoleSchemaAllowedTools(hidden),
-                    taskType: opts.taskType,
-                    maxLoopIterations: opts.maxLoopIterations,
-                },
-                provider: preset.provider,
-                model: preset.model,
-                cwd,
-                prompt: finalPrompt,
-                parentSignals: [opts.parentSignal, callParentSignal],
-                watchdogPolicy: resolveAgentWatchdogPolicy(agent, {
-                    idleTimeoutMs: Number.isFinite(callIdleTimeoutMs)
-                        ? callIdleTimeoutMs
-                        : opts.idleTimeoutMs,
-                    firstResponseTimeoutMs: opts.firstResponseTimeoutMs,
-                }),
-            });
-            return opts.brief === false ? raw : applyBriefCap(raw);
-        }
         const { session } = prepareAgentSession({
             agent,
             presetName,

package/src/runtime/agent/orchestrator/providers/admission-scheduler.mjs

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto';
 import { AsyncLocalStorage } from 'node:async_hooks';
+import { resourceAdmission } from '../../../shared/resource-admission.mjs';
 
 // Normal provider traffic is not concurrency-gated. Independent sessions and
 // accounts start immediately; a finite limit exists only when an operator
@@ -577,28 +578,33 @@ export function wrapProviderAdmission(provider, providerName, scheduler = provid
         const opts = sendOpts || {};
         const signal = opts.signal || null;
         const key = providerAdmissionKey(providerName, this);
-        return scheduler.run(key, (admissionSignal) => {
-            // Admission is the common request-clock boundary for WS/SSE/HTTP.
-            // Queue wait therefore cannot consume first-byte or agent-watchdog
-            // time. Provider-local retry remains the sole retry owner.
-            try { opts.onStageChange?.('requesting'); } catch {}
-            return originalSend.call(this, messages, model, tools, {
-                ...opts,
-                signal: admissionSignal,
-            });
-        }, {
-            signal,
-            ownerKey: opts.admissionOwner || opts.sessionId || null,
-            priority: opts.admissionPriority || 'user-visible',
-            onCooldownWait: (waitMs) => {
-                // Display-only: the TUI/desktop 'reconnecting' stage already
-                // renders a custom verb, so no new stage vocabulary is needed.
-                const secs = Math.max(1, Math.ceil(waitMs / 1000));
-                try {
-                    opts.onStageChange?.('reconnecting', { message: `Rate-limited — waiting ~${secs}s for the provider window` });
-                } catch { /* display-only */ }
-            },
-        });
+        // Provider queueing and network wait consume no local CPU slot. The
+        // resource controller reacquires the agent lease before model output
+        // continues through local context/tool processing.
+        return resourceAdmission.runYielded(() =>
+            scheduler.run(key, (admissionSignal) => {
+                // Admission is the common request-clock boundary for WS/SSE/HTTP.
+                // Queue wait therefore cannot consume first-byte or agent-watchdog
+                // time. Provider-local retry remains the sole retry owner.
+                try { opts.onStageChange?.('requesting'); } catch {}
+                return originalSend.call(this, messages, model, tools, {
+                    ...opts,
+                    signal: admissionSignal,
+                });
+            }, {
+                signal,
+                ownerKey: opts.admissionOwner || opts.sessionId || null,
+                priority: opts.admissionPriority || 'user-visible',
+                onCooldownWait: (waitMs) => {
+                    // Display-only: the TUI/desktop 'reconnecting' stage already
+                    // renders a custom verb, so no new stage vocabulary is needed.
+                    const secs = Math.max(1, Math.ceil(waitMs / 1000));
+                    try {
+                        opts.onStageChange?.('reconnecting', { message: `Rate-limited — waiting ~${secs}s for the provider window` });
+                    } catch { /* display-only */ }
+                },
+            })
+        );
     };
     return provider;
 }

package/src/runtime/agent/orchestrator/session/manager/turn-checkpoint.mjs

@@ -64,27 +64,12 @@ export function projectTurnCheckpointMessages(session, checkpoint) {
         || !Array.isArray(checkpoint?.turnMessages)) return source;
     const sessionGeneration = Number(session.generation) || 0;
     const checkpointGeneration = Number(checkpoint.generation) || 0;
-    const owner = String(session.owner || '').trim().toLowerCase();
-    const agent = String(session.agent || '').trim().toLowerCase();
-    const detachedLiveAgent = session.closed === true
-        && (owner === 'agent' || (agent && agent !== 'lead'))
-        && Boolean(String(session.ownerSessionId || session.parentSessionId || '').trim());
     const markerToken = typeof session.activeTurnCheckpoint?.turnToken === 'string'
         ? session.activeTurnCheckpoint.turnToken
         : null;
     const markerMatches = markerToken === checkpoint.turnToken;
     const checkpointIsNewer = Number(checkpoint.updatedAt) > Number(session.updatedAt || 0);
-    // External workers deliberately detach the durable session before their
-    // shard-owned turn finishes. closeSession writes the lifecycle fence by
-    // advancing the session generation once, while that already-running turn
-    // keeps publishing under its original generation. Accept exactly that
-    // one-generation handoff only when the durable marker token still proves
-    // identity and the checkpoint was written after the detach.
-    const detachedGenerationHandoff = detachedLiveAgent
-        && sessionGeneration === checkpointGeneration + 1
-        && markerMatches
-        && checkpointIsNewer;
-    if ((checkpointGeneration !== sessionGeneration && !detachedGenerationHandoff)
+    if (checkpointGeneration !== sessionGeneration
         || (markerToken && !markerMatches)
         || (!markerToken && !checkpointIsNewer)) return source;
     let start = -1;

package/src/runtime/agent/orchestrator/session/token-native.mjs

@@ -1,6 +1,6 @@
 // Native mixdog-token client: a Node Worker owns the in-process Node-API addon
-// so CPU-heavy counting never blocks the daemon event loop. Session shards
-// relay to this single owner over their existing IPC channel.
+// so CPU-heavy counting never blocks the daemon event loop. The session
+// runtime worker relays to this single owner over its existing IPC channel.
 //
 // Unavailable addon / dead worker / timeout all resolve `null`, and callers
 // fall back to the WASM worker path. Kill switch:
@@ -23,16 +23,16 @@ const LOCAL_ADDON = pathJoin(
 );
 const READY_TIMEOUT_MS = 10_000;
 const REQUEST_TIMEOUT_MS = 30_000;
-const SHARD_PREWARM_MESSAGE = 'token-native-prewarm';
-const SHARD_COUNT_MESSAGE = 'token-native-count';
-const SHARD_RESULT_MESSAGE = 'token-native-result';
+const RUNTIME_PREWARM_MESSAGE = 'token-native-prewarm';
+const RUNTIME_COUNT_MESSAGE = 'token-native-count';
+const RUNTIME_RESULT_MESSAGE = 'token-native-result';
 
-function isSessionShardProcess() {
-    return process.env.MIXDOG_SESSION_SHARD_PID === String(process.pid);
+function isSessionRuntimeWorkerProcess() {
+    return process.env.MIXDOG_SESSION_RUNTIME_WORKER_PID === String(process.pid);
 }
 
-function sessionShardClientEnabled() {
-    return isSessionShardProcess()
+function sessionRuntimeClientEnabled() {
+    return isSessionRuntimeWorkerProcess()
         && typeof process.send === 'function'
         && process.connected === true;
 }
@@ -66,61 +66,61 @@ function _resolveAddon() {
 
 let _workerOwner = null; // { worker, pending, seq, ready, resolveReady, readyTimer }
 let _workerFailed = false;
-let _shardSequence = 0;
-let _shardListenerInstalled = false;
-const _shardPending = new Map();
+let _runtimeSequence = 0;
+let _runtimeListenerInstalled = false;
+const _runtimePending = new Map();
 
-function _dropShardRequests() {
-    for (const entry of _shardPending.values()) {
+function _dropRuntimeRequests() {
+    for (const entry of _runtimePending.values()) {
         clearTimeout(entry.timer);
         entry.resolve(null);
     }
-    _shardPending.clear();
+    _runtimePending.clear();
 }
 
-function _ensureShardResponseListener() {
-    if (_shardListenerInstalled) return;
-    _shardListenerInstalled = true;
+function _ensureRuntimeResponseListener() {
+    if (_runtimeListenerInstalled) return;
+    _runtimeListenerInstalled = true;
     process.on('message', (message) => {
-        if (!message || message.type !== SHARD_RESULT_MESSAGE) return;
+        if (!message || message.type !== RUNTIME_RESULT_MESSAGE) return;
         const tokenRequestId = String(message.tokenRequestId || '');
-        const entry = _shardPending.get(tokenRequestId);
+        const entry = _runtimePending.get(tokenRequestId);
         if (!entry) return;
-        _shardPending.delete(tokenRequestId);
+        _runtimePending.delete(tokenRequestId);
         clearTimeout(entry.timer);
         const count = Number(message.count);
         entry.resolve(Number.isFinite(count) && count >= 0 ? count : null);
     });
-    process.once('disconnect', _dropShardRequests);
+    process.once('disconnect', _dropRuntimeRequests);
 }
 
-function _requestShardTokenCount(text, timeoutMs = REQUEST_TIMEOUT_MS) {
-    if (!sessionShardClientEnabled()) return Promise.resolve(null);
-    _ensureShardResponseListener();
-    const tokenRequestId = `token-${process.pid}-${++_shardSequence}`;
+function _requestRuntimeTokenCount(text, timeoutMs = REQUEST_TIMEOUT_MS) {
+    if (!sessionRuntimeClientEnabled()) return Promise.resolve(null);
+    _ensureRuntimeResponseListener();
+    const tokenRequestId = `token-${process.pid}-${++_runtimeSequence}`;
     return new Promise((resolve) => {
         const timer = setTimeout(() => {
-            if (!_shardPending.delete(tokenRequestId)) return;
+            if (!_runtimePending.delete(tokenRequestId)) return;
             resolve(null);
         }, timeoutMs);
         timer.unref?.();
-        _shardPending.set(tokenRequestId, { resolve, timer });
+        _runtimePending.set(tokenRequestId, { resolve, timer });
         if (!safeIpcSend(process, {
-            type: SHARD_COUNT_MESSAGE,
+            type: RUNTIME_COUNT_MESSAGE,
             tokenRequestId,
             text: String(text ?? ''),
         }, {
             onError: () => {
-                const entry = _shardPending.get(tokenRequestId);
+                const entry = _runtimePending.get(tokenRequestId);
                 if (!entry) return;
-                _shardPending.delete(tokenRequestId);
+                _runtimePending.delete(tokenRequestId);
                 clearTimeout(entry.timer);
                 entry.resolve(null);
             },
         })) {
-            const entry = _shardPending.get(tokenRequestId);
+            const entry = _runtimePending.get(tokenRequestId);
             if (entry) {
-                _shardPending.delete(tokenRequestId);
+                _runtimePending.delete(tokenRequestId);
                 clearTimeout(entry.timer);
                 entry.resolve(null);
             }
@@ -241,17 +241,17 @@ function _requestWorker(owner, text, timeoutMs = REQUEST_TIMEOUT_MS) {
 
 /** True when the native counter can be attempted (mode on + addon present). */
 export function nativeTokenCounterEnabled() {
-    if (isSessionShardProcess()) {
-        return nativeTokenModeEnabled() && sessionShardClientEnabled();
+    if (isSessionRuntimeWorkerProcess()) {
+        return nativeTokenModeEnabled() && sessionRuntimeClientEnabled();
     }
     return nativeTokenModeEnabled() && !_workerFailed && Boolean(_resolveAddon());
 }
 
 /** Precise o200k count via the daemon-owned addon worker. */
 export async function countTokensNative(text) {
-    if (isSessionShardProcess()) {
+    if (isSessionRuntimeWorkerProcess()) {
         if (!nativeTokenModeEnabled()) return null;
-        return _requestShardTokenCount(text);
+        return _requestRuntimeTokenCount(text);
     }
     const owner = _ensureWorker();
     if (!owner) return null;
@@ -267,9 +267,9 @@ let _fetchAttempted = false;
  *  With no local/env/cached addon, kick ONE background manifest fetch; on
  *  success the resolution cache resets so the next estimate adopts it. */
 export function prewarmNativeTokenCounter() {
-    if (isSessionShardProcess()) {
-        if (!nativeTokenModeEnabled() || !sessionShardClientEnabled()) return false;
-        return safeIpcSend(process, { type: SHARD_PREWARM_MESSAGE }, { onError: () => {} });
+    if (isSessionRuntimeWorkerProcess()) {
+        if (!nativeTokenModeEnabled() || !sessionRuntimeClientEnabled()) return false;
+        return safeIpcSend(process, { type: RUNTIME_PREWARM_MESSAGE }, { onError: () => {} });
     }
     const owner = _ensureWorker();
     if (!owner) {

package/src/runtime/agent/orchestrator/tools/builtin/list-tool-integrity.test.mjs

@@ -4,7 +4,7 @@ import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import test from 'node:test';
 
-import { recordShardDirectoryReadSuccess } from '../../../../shared/session-shard-health.mjs';
+import { recordRuntimeDirectoryReadSuccess } from '../../../../shared/session-runtime-health.mjs';
 import { executeListTool, executeTreeTool } from './list-tool.mjs';
 
 function readdirError(code, message = 'injected readdir failure') {
@@ -32,14 +32,14 @@ test('aborted list work cannot poison the result cache', async () => {
     }
 });
 
-test('root readdir failures are errors, stay uncached, and mark a repeatedly failing shard unhealthy', async () => {
-    const originalShardPid = process.env.MIXDOG_SESSION_SHARD_PID;
+test('root readdir failures are errors, stay uncached, and mark a repeatedly failing runtime worker unhealthy', async () => {
+    const originalRuntimeWorkerPid = process.env.MIXDOG_SESSION_RUNTIME_WORKER_PID;
     const roots = [];
     let unhealthy = null;
     const onUnhealthy = (detail) => { unhealthy = detail; };
-    process.env.MIXDOG_SESSION_SHARD_PID = String(process.pid);
-    process.on('mixdog:session-shard-unhealthy', onUnhealthy);
-    recordShardDirectoryReadSuccess();
+    process.env.MIXDOG_SESSION_RUNTIME_WORKER_PID = String(process.pid);
+    process.on('mixdog:session-runtime-worker-unhealthy', onUnhealthy);
+    recordRuntimeDirectoryReadSuccess();
     try {
         for (let index = 0; index < 3; index += 1) {
             const root = await mkdtemp(join(tmpdir(), `mixdog-list-root-fail-${index}-`));
@@ -58,10 +58,10 @@ test('root readdir failures are errors, stay uncached, and mark a repeatedly fai
             /entry-0\.txt\tfile/,
         );
     } finally {
-        recordShardDirectoryReadSuccess();
-        process.off('mixdog:session-shard-unhealthy', onUnhealthy);
-        if (originalShardPid === undefined) delete process.env.MIXDOG_SESSION_SHARD_PID;
-        else process.env.MIXDOG_SESSION_SHARD_PID = originalShardPid;
+        recordRuntimeDirectoryReadSuccess();
+        process.off('mixdog:session-runtime-worker-unhealthy', onUnhealthy);
+        if (originalRuntimeWorkerPid === undefined) delete process.env.MIXDOG_SESSION_RUNTIME_WORKER_PID;
+        else process.env.MIXDOG_SESSION_RUNTIME_WORKER_PID = originalRuntimeWorkerPid;
         await Promise.all(roots.map((root) => rm(root, { recursive: true, force: true })));
     }
 });

package/src/runtime/agent/orchestrator/tools/builtin/list-tool.mjs

@@ -48,9 +48,9 @@ import {
 import { assertPathReachable } from './fs-reachability.mjs';
 import { listGuardPath, normalizeListHeadLimit, readFamilyPathEnoentOrError } from './lib/list-helpers.mjs';
 import {
-    recordShardDirectoryReadSuccess,
-    reportShardDirectoryReadFailure,
-} from '../../../../shared/session-shard-health.mjs';
+    recordRuntimeDirectoryReadSuccess,
+    reportRuntimeDirectoryReadFailure,
+} from '../../../../shared/session-runtime-health.mjs';
 
 const FIND_WALK_TIMEOUT_MS = 20_000;
 const LIST_WALK_TIMEOUT_MS = 20_000;
@@ -358,12 +358,12 @@ export async function executeListTool(args, workDir, options = {}) {
     throwIfDirectoryWalkAborted(options.signal, walkResult, 'list walk');
     const rootFailure = walkWarnings.find((warning) => warning.root);
     if (rootFailure) {
-        reportShardDirectoryReadFailure(fullPath, rootFailure.error);
+        reportRuntimeDirectoryReadFailure(fullPath, rootFailure.error);
         recordDirectoryWalkTelemetry(options, 'failed', walkResult, walkWarnings.length);
         if (options?.scopedCacheOutcome) markScopedCacheIncomplete(options.scopedCacheOutcome);
         return directoryReadFailureLine(rootFailure);
     }
-    recordShardDirectoryReadSuccess();
+    recordRuntimeDirectoryReadSuccess();
 
     if (!nativeDeep && needsGlobalStat && rows.length > 0) {
         // lstat: symlinks should report own metadata, not the target's.
@@ -523,12 +523,12 @@ export async function executeTreeTool(args, workDir, options = {}) {
     throwIfDirectoryWalkAborted(options.signal, walkResult, 'tree walk');
     const rootFailure = walkWarnings.find((warning) => warning.root);
     if (rootFailure) {
-        reportShardDirectoryReadFailure(fullPath, rootFailure.error);
+        reportRuntimeDirectoryReadFailure(fullPath, rootFailure.error);
         recordDirectoryWalkTelemetry(options, 'failed', walkResult, walkWarnings.length);
         if (options?.scopedCacheOutcome) markScopedCacheIncomplete(options.scopedCacheOutcome);
         return directoryReadFailureLine(rootFailure);
     }
-    recordShardDirectoryReadSuccess();
+    recordRuntimeDirectoryReadSuccess();
     const root = lines[0];
     const body = lines.slice(1);
     const windowed = offset > 0 ? body.slice(offset) : body;

package/src/runtime/agent/orchestrator/tools/builtin/native-search-client.mjs

@@ -8,7 +8,7 @@ import { spawn } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { createInterface } from 'node:readline';
 import { hiddenSpawnOpts } from '../../../../shared/spawn-flags.mjs';
-import { reportShardUnhealthy } from '../../../../shared/session-shard-health.mjs';
+import { reportRuntimeWorkerUnhealthy } from '../../../../shared/session-runtime-health.mjs';
 import { invalidateBuiltinResultCache } from './cache-layers.mjs';
 import { getPluginData } from '../../config.mjs';
 import { ensureGraphBinary } from '../graph-binary-fetcher.mjs';
@@ -103,8 +103,8 @@ function noteSearchTimeout(server, now = Date.now()) {
   if (sincePrevious <= SEARCH_TIMEOUT_BURST_MS) return 'none';
   // The server is no longer recycled on a first timeout, so a recurrence
   // within the window — on this server or its replacement — is what marks the
-  // shard unhealthy.
-  return sincePrevious <= SEARCH_TIMEOUT_RECYCLE_WINDOW_MS ? 'shard' : 'server';
+  // runtime worker unhealthy.
+  return sincePrevious <= SEARCH_TIMEOUT_RECYCLE_WINDOW_MS ? 'runtime' : 'server';
 }
 
 function subscribeAbortSignal(signal, callback) {
@@ -226,7 +226,7 @@ export function _bindNativeSearchServerLifecycle(child, { onError, onExit } = {}
   child.on('exit', onExit);
   // ChildProcess stdin emits write failures asynchronously. A sync try/catch
   // around stdin.write cannot catch EPIPE; without this listener the session
-  // shard itself terminates and every active/queued turn is crash-recovered.
+  // runtime worker itself terminates and every active/queued turn is recovered.
   child.stdin?.on?.('error', onError);
 }
 
@@ -480,8 +480,8 @@ async function requestNative(server, request, execOptions, deadlineMs) {
       // already told it to stop, and the cancellation watchdog tears it down
       // if it does not comply. Killing it here also destroyed every warm
       // inventory, so the next call re-walked from cold and timed out again.
-      if (action !== 'shard') return;
-      reportShardUnhealthy({
+      if (action !== 'runtime') return;
+      reportRuntimeWorkerUnhealthy({
         reason: 'native search timed out again after server recycle',
         code: 'NATIVE_SEARCH_TIMEOUT_STREAK',
         subsystem: 'native-search',

package/src/runtime/shared/child-spawn-remote.mjs

@@ -1,14 +1,13 @@
 'use strict';
 
-// Shard-side client for the MACHINE-WIDE child-spawn budget.
+// Runtime-worker client for the MACHINE-WIDE child-spawn budget.
 //
 // child-spawn-gate's semaphore was written for the single-process daemon; the
-// session-shard split copied it into every shard process, multiplying the
-// "global" spawn cap by the shard count (8 shards × search cap 4 = 32
-// concurrent scanners — exactly the Defender/disk amplification the cap was
-// built to prevent). In shard processes the gate therefore forwards each
-// acquire as a lease request over the existing pool IPC channel; the
-// daemon-side pool grants leases from its OWN child-spawn-gate instance,
+// session-runtime split creates another process-local copy, which would
+// multiply the intended machine-wide cap. In the runtime worker the gate
+// therefore forwards each
+// acquire as a lease request over the existing runtime IPC channel; the
+// daemon-side host grants leases from its OWN child-spawn-gate instance,
 // which becomes the single machine-wide authority (daemon-hosted maintenance
 // agents already use that instance locally). Transport loss degrades to the
 // local per-process lane — bounded, never unbounded.
@@ -53,7 +52,7 @@ function _ensureListener() {
 
 export function remoteSpawnLeasesEnabled(env = process.env) {
   return !_broken
-    && env.MIXDOG_SESSION_SHARD === '1'
+    && env.MIXDOG_SESSION_RUNTIME_WORKER === '1'
     && env.MIXDOG_DISABLE_MACHINE_SPAWN_BUDGET !== '1'
     && typeof process.send === 'function'
     && process.connected === true;

package/src/runtime/shared/resource-admission.mjs

@@ -255,6 +255,26 @@ export class ResourceAdmissionController {
     return this.context.run(lease, task);
   }
 
+  /**
+   * Yield the current agent lease while waiting on remote I/O, then reacquire
+   * it before the caller continues local processing. Non-agent callers are a
+   * no-op. Nested yields share the same dependency depth and restore once.
+   */
+  async runYielded(task) {
+    if (typeof task !== 'function') return Promise.resolve().then(task);
+    const lease = this.context.getStore();
+    if (!lease || lease.controller !== this || lease.kind !== 'agent' || lease.released) {
+      return Promise.resolve().then(task);
+    }
+    const suspended = this._suspendParent(lease);
+    this._drain();
+    try {
+      return await task();
+    } finally {
+      await this._resumeParent(suspended);
+    }
+  }
+
   acquire(kind, {
     signal = null, label = null, dependency = 'scoped', ownerKey = null,
     priority = 'user-visible',

package/src/runtime/shared/resource-admission.test.mjs

@@ -0,0 +1,43 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { ResourceAdmissionController } from './resource-admission.mjs';
+
+test('provider-style waits yield and reacquire the current agent lease', async () => {
+  const admission = new ResourceAdmissionController({
+    limits: {
+      maxAgents: 1,
+      maxShells: 1,
+      maxHighLoad: 1,
+      maxQueue: 8,
+    },
+  });
+  const first = await admission.acquire('agent', { ownerKey: 'first' });
+  const waitStarted = Promise.withResolvers();
+  const finishWait = Promise.withResolvers();
+  let yieldedFinished = false;
+
+  const yielding = admission.runWithLease(first, () => admission.runYielded(async () => {
+    waitStarted.resolve();
+    await finishWait.promise;
+    return 'provider-result';
+  })).then((value) => {
+    yieldedFinished = true;
+    return value;
+  });
+
+  await waitStarted.promise;
+  assert.equal(admission.snapshot().active.agent, 0);
+  const second = await admission.acquire('agent', { ownerKey: 'second' });
+  assert.equal(admission.snapshot().active.agent, 1);
+
+  finishWait.resolve();
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.equal(yieldedFinished, false, 'the first continuation waits to reacquire its slot');
+
+  await second.release();
+  assert.equal(await yielding, 'provider-result');
+  assert.equal(admission.snapshot().active.agent, 1);
+  await first.release();
+  assert.equal(admission.snapshot().active.agent, 0);
+});