mixdog 0.9.147 → 0.9.149

package/src/standalone/session-client.mjs

@@ -26,6 +26,7 @@ import {
   SESSION_READ_ACTION_SET,
 } from './session-protocol.mjs';
 import { readSingletonOwner } from '../runtime/shared/singleton-owner.mjs';
+import { isPidAlive } from '../runtime/shared/pid-liveness.mjs';
 import { resolveRuntimeRoot } from '../runtime/shared/runtime-root.mjs';
 
 function runtimeRoot() {
@@ -86,6 +87,7 @@ const EVENT_STREAM_RECONNECT_MAX_MS = 30_000;
 const EVENT_STREAM_LIVENESS_TIMEOUT_MS = 45_000;
 const EVENT_STREAM_RECONNECT_BUDGET_MS = 10 * 60_000;
 const DEFAULT_DAEMON_READY_TIMEOUT_MS = 15_000;
+const DEFAULT_DAEMON_UPGRADE_TIMEOUT_MS = 120_000;
 const DAEMON_OWNER_POLL_MS = 50;
 // A daemon that restarted needs a moment to rebind its port, so one immediate
 // re-attach often lands in the same gap the first call died in. Mirror the
@@ -146,13 +148,6 @@ export async function probeSessionHealth({ port, token, timeoutMs = 800 } = {})
   } catch { return null; }
 }
 
-function isPidAlive(pid) {
-  const value = Number(pid);
-  if (!Number.isInteger(value) || value <= 0) return false;
-  try { process.kill(value, 0); return true; }
-  catch (error) { return error?.code === 'EPERM'; }
-}
-
 export function readSessionDiscovery(discoveryPath = sessionDiscoveryPath()) {
   const readUnified = (candidate) => {
     const parsed = JSON.parse(readFileSync(candidate, 'utf8'));
@@ -208,9 +203,15 @@ export function sessionDaemonCompatibility(health, {
 
 async function replaceLowerDaemon(discovery, initialHealth, { log }) {
   const configuredTimeoutMs = Number(process.env.MIXDOG_DAEMON_UPGRADE_TIMEOUT_MS);
-  const deadline = configuredTimeoutMs > 0
-    ? Date.now() + Math.max(10_000, configuredTimeoutMs)
-    : Number.POSITIVE_INFINITY;
+  // A stuck older daemon (a worker that never finishes draining) must not hang
+  // every newer client forever: the wait is always bounded, and the caller
+  // surfaces `daemonUpgradePending` instead of blocking indefinitely.
+  // Infinity/NaN are NOT a configuration — they are the unbounded wait this
+  // deadline exists to prevent, so they fall back to the default.
+  const boundedTimeoutMs = Number.isFinite(configuredTimeoutMs) && configuredTimeoutMs > 0
+    ? Math.max(10_000, configuredTimeoutMs)
+    : DEFAULT_DAEMON_UPGRADE_TIMEOUT_MS;
+  const deadline = Date.now() + boundedTimeoutMs;
   const result = await request({
     port: discovery.port,
     token: discovery.token,
@@ -638,7 +639,12 @@ export async function attachSession({
       err.daemonTransportError = true;
       throw err;
     }
-    if (out && out.error) throw new Error(out.error);
+    if (out && out.error) {
+      // Preserve the daemon's machine-readable classification across the wire.
+      const err = new Error(out.error);
+      if (out.code) err.code = String(out.code);
+      throw err;
+    }
     return out?.result;
   }
 
@@ -751,6 +757,13 @@ async function ensureSharedAttachment({ cwd, log }) {
       onFatal: (reason) => {
         log(`daemon attachment lost (${reason})`);
         if (shared === state) shared = null;
+        // The dead attachment still owns a server-side client record and its
+        // session subscriptions. Release it explicitly; otherwise every fatal
+        // re-attach cycle leaks one client (and one subscriber per session) on
+        // the daemon until its pid sweep runs.
+        void Promise.resolve()
+          .then(() => state.client?.close?.(`attachment lost: ${reason}`))
+          .catch((err) => log(`daemon attachment release failed: ${err?.message || err}`));
         for (const bucket of views.values()) {
           for (const view of [...bucket]) view.applyDetached(reason);
         }
@@ -872,8 +885,19 @@ export async function createSession(options = {}) {
   }
 
   let resyncing = false;
+  // A revision gap that lands while a read is already in flight is NOT covered
+  // by that read: it must re-run afterwards, otherwise the view stays stale
+  // forever behind a coalesced request.
+  let resyncDirty = false;
+  let resyncDirtyReason = '';
+  let resyncFailed = false;
   function resync(reason) {
-    if (disposed || resyncing) return;
+    if (disposed) return;
+    if (resyncing) {
+      resyncDirty = true;
+      resyncDirtyReason = String(reason || 'revision gap');
+      return;
+    }
     resyncing = true;
     const requestAttachment = attachment;
     void requestAttachment.client.read({
@@ -885,10 +909,28 @@ export async function createSession(options = {}) {
       if (result && typeof result === 'object') resultAttachments.set(result, requestAttachment);
       if (!applyBody(result, requestAttachment) && result?.revision !== undefined) {
         log(`session ${sessionId} resync returned an unusable body`);
+        resyncDirty = true;
+        resyncFailed = true;
+        resyncDirtyReason = 'unusable resync body';
       }
     }).catch((err) => {
       log(`session ${sessionId} resync after ${reason} failed: ${err?.message || err}`);
-    }).finally(() => { resyncing = false; });
+      resyncDirty = true;
+      resyncFailed = true;
+      resyncDirtyReason = `retry after failed resync (${reason})`;
+    }).finally(() => {
+      resyncing = false;
+      if (!resyncDirty || disposed) return;
+      resyncDirty = false;
+      const retryReason = resyncDirtyReason || 'revision gap';
+      resyncDirtyReason = '';
+      if (!resyncFailed) { resync(retryReason); return; }
+      // A failing daemon must not spin: retry the coalesced gap on a short
+      // fixed delay instead of a tight loop.
+      resyncFailed = false;
+      const timer = setTimeout(() => { if (!disposed) resync(retryReason); }, 250);
+      timer.unref?.();
+    });
   }
 
   let recoveryPromise = null;
@@ -1038,6 +1080,13 @@ export async function createSession(options = {}) {
     transitionChain = run.then(() => {}, () => {});
     return run;
   }
+  // Mutations must not queue behind each other (ESC/abort stays immediate), but
+  // they MUST observe the session a new/resume transition is rebinding to.
+  // Joining the current tail of the transition chain — without extending it —
+  // keeps a prompt from routing to the session that was just replaced.
+  function afterPendingTransition() {
+    return transitionChain;
+  }
 
   function remoteCall(method, args, callOptions = {}) {
     if (disposed) return Promise.reject(new Error('This session view is disposed.'));
@@ -1047,21 +1096,28 @@ export async function createSession(options = {}) {
         ? 'session.configure'
         : null;
     if (!route) return Promise.reject(new TypeError(`session action ${method} is unavailable`));
-    const targetSessionId = sessionId;
-    const baseRevision = baseRevisionFor(attachment, targetSessionId);
     const stableCallId = typeof callOptions.callId === 'string' && callOptions.callId.trim()
       ? callOptions.callId.trim()
       : randomUUID();
-    return sendCall(route, {
-      sessionId: targetSessionId,
-      action: method,
-      args,
-      open: openParams,
-      baseRevision,
-    }, stableCallId).then(async (result) => {
+    const dispatch = async () => {
+      if (disposed) throw new Error('This session view is disposed.');
+      const targetSessionId = sessionId;
+      const baseRevision = baseRevisionFor(attachment, targetSessionId);
+      const result = await sendCall(route, {
+        sessionId: targetSessionId,
+        action: method,
+        args,
+        open: openParams,
+        baseRevision,
+      }, stableCallId);
       if (!disposed && sessionId === targetSessionId) await applyResult(result, method);
       return result?.value ?? null;
-    });
+    };
+    // Reads stay immediate; a configure action is a mutation and waits out an
+    // in-flight new/resume rebind.
+    return route === 'session.configure'
+      ? afterPendingTransition().then(dispatch)
+      : dispatch();
   }
 
   async function rebindTo(result, previousSessionId) {
@@ -1122,6 +1178,9 @@ export async function createSession(options = {}) {
     if (disposed) throw new Error('This session view is disposed.');
     const submissionId = String(options?.id || '').trim()
       || `session-submit-${process.pid}-${Date.now()}-${(submitSeq += 1)}`;
+    // Never address the session a new/resume transition is replacing.
+    await afterPendingTransition();
+    if (disposed) throw new Error('This session view is disposed.');
     const targetSessionId = sessionId;
     const baseRevision = baseRevisionFor(attachment, targetSessionId);
     const result = await sendCall('session.submit', {
@@ -1136,6 +1195,10 @@ export async function createSession(options = {}) {
   }
 
   async function abortAsync(options = {}) {
+    if (disposed) return { aborted: false };
+    // Abort skips the ordinary call queue but still targets the CURRENT
+    // session: a rebind in flight owns the runtime the user is aborting.
+    await afterPendingTransition();
     if (disposed) return { aborted: false };
     const result = await sendCall('session.abort', {
       sessionId, open: openParams, options,

package/src/standalone/session-protocol.mjs

@@ -64,7 +64,6 @@ export const SESSION_CONFIGURE_ACTIONS = Object.freeze([
   'cancelMediaJob',
   'cancelOAuthProviderLogin',
   'checkForUpdate',
-  'claimRemote',
   'clear',
   'compact',
   'completeOnboarding',
@@ -148,7 +147,6 @@ export const SESSION_CONFIGURE_ACTIONS = Object.freeze([
   'switchContext',
   'taskControl',
   'toggleFast',
-  'toggleRemote',
   'toggleVoice',
   'transcribeAudio',
   'updatePlugin',

package/src/standalone/session-runtime-host-health.test.mjs

@@ -72,15 +72,16 @@ test('an unhealthy runtime worker is replaced and every runtime is recovered', a
     const originalPid = host.status.worker.pid;
     assert.equal((await first.submitAsync('trigger')).pid, originalPid);
     await waitFor(
-      () => host.status.worker.pid && host.status.worker.pid !== originalPid,
-      'replacement runtime worker',
+      () => host.status.worker.pid
+        && host.status.worker.pid !== originalPid
+        && logs.some((line) => /recycling.*unhealthy/.test(line))
+        && logs.some((line) => /recovered 2 runtime/.test(line)),
+      'replacement runtime worker recovery',
     );
     const healthyFirst = await first.submitAsync('healthy');
     const healthySecond = await second.submitAsync('healthy');
     assert.notEqual(healthyFirst.pid, originalPid);
     assert.equal(healthySecond.pid, healthyFirst.pid);
-    assert.ok(logs.some((line) => /unhealthy; recycling/.test(line)));
-    assert.ok(logs.some((line) => /recovered 2 runtime/.test(line)));
   } finally {
     await host.close('test complete');
     await rm(dir, { recursive: true, force: true });

package/src/standalone/session-runtime-host.mjs

@@ -30,6 +30,24 @@ const RUNTIME_METHODS = new Set([
   'dispose',
 ]);
 
+export function shouldRecycleSessionRuntimeWorker({
+  rssBytes = 0,
+  thresholdBytes = 0,
+  daemonBusy = 0,
+  pending = 0,
+  activeResources = 0,
+  now = Date.now(),
+  lastRecycleAt = 0,
+  cooldownMs = 0,
+} = {}) {
+  return Number(thresholdBytes) > 0
+    && Number(rssBytes) >= Number(thresholdBytes)
+    && Number(daemonBusy) === 0
+    && Number(pending) === 0
+    && Number(activeResources) === 0
+    && Number(now) - Number(lastRecycleAt) >= Math.max(0, Number(cooldownMs) || 0);
+}
+
 export function applyRuntimeStateFrame(previous, frame) {
   if (frame?.full && typeof frame.full === 'object') return frame.full;
   const patch = frame?.patch;
@@ -84,6 +102,10 @@ class SessionRuntimeWorker {
 
   onMessage(message, child = this.child) {
     if (!message || typeof message !== 'object') return;
+    // A superseded child (recycled, crashed, or replaced) can still flush
+    // queued frames after its replacement is live. Its late state/response must
+    // never outrank the replacement's revision or settle its pending calls.
+    if (child !== this.child) return;
     if (message.type === 'token-native-prewarm') {
       if (child === this.child) prewarmNativeTokenCounter();
       return;
@@ -162,6 +184,12 @@ class SessionRuntimeWorker {
   handleChildFailure(child, error) {
     if (this.failedChildren.has(child)) return;
     this.failedChildren.add(child);
+    // Same identity rule for failures: a retired child's late exit/error must
+    // not reject the replacement's in-flight calls or start a second recovery.
+    if (this.child && this.child !== child) {
+      this.log(`session runtime worker superseded child failed (ignored): ${error?.message || error}`);
+      return;
+    }
     if (this.child === child) this.child = null;
     // A dead child cannot spawn: its machine-budget slots return immediately.
     this.releaseAllSpawnLeases();
@@ -197,16 +225,29 @@ class SessionRuntimeWorker {
     return false;
   }
 
-  recycleUnhealthy(child, detail = null) {
+  recycleChild(child, reason) {
     if (this.closed || child !== this.child || this.recycling) return;
-    const reason = String(detail?.reason || 'session runtime worker reported unhealthy');
-    this.log(`session runtime worker unhealthy; recycling pid=${child.pid || 'unknown'}: ${reason}`);
-    this.recycling = this.stopChild(`unhealthy: ${reason}`)
+    this.log(`session runtime worker recycling pid=${child.pid || 'unknown'}: ${reason}`);
+    this.recycling = this.stopChild(reason)
+      .then(() => true)
       .catch((error) => {
-        this.log(`session runtime worker unhealthy recycle failed: ${error?.message || error}`);
+        this.log(`session runtime worker recycle failed: ${error?.message || error}`);
         try { child.kill?.(); } catch {}
+        return false;
       })
       .finally(() => { this.recycling = null; });
+    return this.recycling;
+  }
+
+  recycleUnhealthy(child, detail = null) {
+    const reason = String(detail?.reason || 'session runtime worker reported unhealthy');
+    void this.recycleChild(child, `unhealthy: ${reason}`);
+  }
+
+  recycleForMemory(rssBytes) {
+    const rssMb = Math.round(Number(rssBytes) / 1024 / 1024);
+    return this.recycleChild(this.child, `idle memory reclaim (${rssMb} MB RSS)`)
+      || Promise.resolve(false);
   }
 
   requestRaw(type, payload = {}, timeoutMs = 10 * 60_000) {
@@ -331,9 +372,11 @@ class SessionRuntimeWorker {
     });
     try { await this.requestRaw('shutdown', { reason }, 8_000); } catch {}
     try { child.disconnect?.(); } catch {}
+    // The child drains its accepted-input writes before exiting; a hard kill
+    // inside that window is exactly what loses them.
     await Promise.race([
       exitPromise,
-      new Promise((resolve) => setTimeout(resolve, 500)),
+      new Promise((resolve) => setTimeout(resolve, 2_000)),
     ]);
     if (!exited) {
       try { child.kill?.(); } catch {}
@@ -472,6 +515,7 @@ export function createSessionRuntimeHost({
   cwd = process.cwd(),
   env = process.env,
   log = () => {},
+  canRecycle = () => true,
 } = {}) {
   const worker = new SessionRuntimeWorker({
     workerEntry,
@@ -487,8 +531,23 @@ export function createSessionRuntimeHost({
 
   // Runtime workload telemetry is refreshed lazily with a short TTL.
   const WORKLOAD_TTL_MS = 2_000;
+  const configuredRecycleMb = Number(env.MIXDOG_SESSION_WORKER_RECYCLE_RSS_MB);
+  const MEMORY_RECYCLE_THRESHOLD_BYTES = (
+    Number.isFinite(configuredRecycleMb) && configuredRecycleMb >= 0
+      ? configuredRecycleMb
+      : 384
+  ) * 1024 * 1024;
+  const MEMORY_RECYCLE_INTERVAL_MS = Math.max(
+    5_000,
+    Number(env.MIXDOG_SESSION_WORKER_RECYCLE_INTERVAL_MS) || 60_000,
+  );
+  const MEMORY_RECYCLE_COOLDOWN_MS = Math.max(
+    60_000,
+    Number(env.MIXDOG_SESSION_WORKER_RECYCLE_COOLDOWN_MS) || 15 * 60_000,
+  );
   let workloadCache = { refreshedAt: 0, worker: null };
   let workloadRefresh = null;
+  let lastMemoryRecycleAt = Date.now();
   function refreshRuntimeWorkload() {
     if (workloadRefresh) return workloadRefresh;
     if (!worker.child || worker.child.killed) {
@@ -512,6 +571,36 @@ export function createSessionRuntimeHost({
     return workloadRefresh;
   }
 
+  async function maybeRecycleWorkerMemory() {
+    if (closed || !worker.child || worker.child.killed || worker.recycling || worker.recovery) return;
+    let daemonBusy = 1;
+    try { daemonBusy = Number(canRecycle()) === 1 ? 0 : 1; } catch {}
+    if (daemonBusy !== 0) return;
+    await refreshRuntimeWorkload();
+    const snapshot = workloadCache.worker;
+    const active = snapshot?.resources?.active || {};
+    const activeResources = Object.values(active)
+      .reduce((sum, value) => sum + Math.max(0, Number(value) || 0), 0);
+    const now = Date.now();
+    if (!shouldRecycleSessionRuntimeWorker({
+      rssBytes: snapshot?.memory?.rssBytes,
+      thresholdBytes: MEMORY_RECYCLE_THRESHOLD_BYTES,
+      daemonBusy,
+      pending: worker.pending.size,
+      activeResources,
+      now,
+      lastRecycleAt: lastMemoryRecycleAt,
+      cooldownMs: MEMORY_RECYCLE_COOLDOWN_MS,
+    })) return;
+    lastMemoryRecycleAt = now;
+    await worker.recycleForMemory(snapshot.memory.rssBytes);
+    workloadCache = { refreshedAt: Date.now(), worker: null };
+  }
+  const memoryRecycleTimer = MEMORY_RECYCLE_THRESHOLD_BYTES > 0
+    ? setInterval(() => { void maybeRecycleWorkerMemory(); }, MEMORY_RECYCLE_INTERVAL_MS)
+    : null;
+  memoryRecycleTimer?.unref?.();
+
   return {
     async create(options = {}) {
       if (closed) throw new Error('session runtime host is closed');
@@ -534,6 +623,7 @@ export function createSessionRuntimeHost({
     async close(reason = 'session runtime host closed') {
       if (closed) return;
       closed = true;
+      if (memoryRecycleTimer) clearInterval(memoryRecycleTimer);
       await worker.close(reason);
     },
     get status() {
@@ -541,6 +631,11 @@ export function createSessionRuntimeHost({
       return {
         active: Boolean(status.pid),
         worker: status,
+        memoryRecycle: {
+          thresholdBytes: MEMORY_RECYCLE_THRESHOLD_BYTES,
+          cooldownMs: MEMORY_RECYCLE_COOLDOWN_MS,
+          lastRecycleAt: lastMemoryRecycleAt,
+        },
       };
     },
   };

package/src/standalone/session-runtime-record.mjs

@@ -10,11 +10,7 @@ export async function disposeSessionRuntimeRecord(records, record, args = []) {
   } finally {
     try { record.unsubscribe?.(); } catch {}
     record.unsubscribe = null;
-    record.source = null;
-    record.projected = null;
-    record.published = null;
-    record.fields?.clear?.();
-    record.items?.clear?.();
+    record.publishedSource = null;
     records?.delete?.(record.id);
   }
 }

package/src/standalone/session-runtime-worker.mjs

@@ -27,10 +27,19 @@ let unhealthyReported = false;
 const pendingAbortPressureChecks = new WeakSet();
 const ABORT_PRESSURE_RETENTION_CHECK_MS = 30_000;
 
+// Reporting is bound to DETECTION, not to a successful runtime call: an idle
+// worker (or one whose every call fails) would otherwise never be recycled.
+function reportUnhealthy() {
+  if (stopping || unhealthyReported || !unhealthyDetail) return;
+  unhealthyReported = true;
+  send({ type: 'unhealthy', detail: unhealthyDetail });
+}
+
 process.on(SESSION_RUNTIME_WORKER_UNHEALTHY_EVENT, (detail) => {
   if (stopping || unhealthyDetail) return;
   unhealthyDetail = sanitizeForWire(detail) || { reason: 'session runtime worker unhealthy' };
   process.stderr.write(`[session-runtime-health] ${unhealthyDetail.reason || 'unhealthy'}\n`);
+  reportUnhealthy();
 });
 
 process.on('warning', (warning) => {
@@ -74,57 +83,21 @@ function errorBody(error) {
   };
 }
 
-function projectState(record, raw) {
-  if (!raw || typeof raw !== 'object') return sanitizeForWire(raw);
-  if (record.source === raw) return record.projected;
-  const fields = record.fields;
-  const items = record.items;
-  const nextItems = new Map();
-  const out = {};
-  for (const [key, value] of Object.entries(raw)) {
-    if (key === 'items' && Array.isArray(value)) {
-      out.items = value.map((item) => {
-        const cached = items.get(item);
-        if (cached !== undefined) {
-          nextItems.set(item, cached);
-          return cached;
-        }
-        const cloned = sanitizeForWire(item);
-        nextItems.set(item, cloned);
-        return cloned;
-      });
-      continue;
-    }
-    const cached = fields.get(key);
-    if (cached && cached.source === value) {
-      out[key] = cached.value;
-      continue;
-    }
-    const cloned = sanitizeForWire(value);
-    if (cloned === undefined) continue;
-    fields.set(key, { source: value, value: cloned });
-    out[key] = cloned;
-  }
-  record.items = nextItems;
-  record.source = raw;
-  record.projected = out;
-  return out;
-}
-
 function publish(record, forceFull = false) {
   if (!record || record.disposed) return;
-  const projected = projectState(record, record.runtime.getState?.() || {});
-  const previous = record.published;
-  if (!forceFull && projected === previous) return;
-  record.published = projected;
+  const source = record.runtime.getState?.() || {};
+  const previous = record.publishedSource;
+  if (!forceFull && source === previous) return;
+  const body = forceFull || !previous
+    ? { full: sanitizeForWire(source) }
+    : { patch: sanitizeForWire(diffSessionState(previous, source)) };
+  record.publishedSource = source;
   record.revision += 1;
   send({
     type: 'state',
     runtimeId: record.id,
     revision: record.revision,
-    ...(forceFull || !previous
-      ? { full: projected }
-      : { patch: diffSessionState(previous, projected) }),
+    ...body,
   });
 }
 
@@ -136,11 +109,7 @@ async function createRuntime(message) {
     runtime,
     unsubscribe: null,
     disposed: false,
-    source: null,
-    projected: null,
-    published: null,
-    fields: new Map(),
-    items: new Map(),
+    publishedSource: null,
     revision: 0,
   };
   records.set(record.id, record);
@@ -170,7 +139,6 @@ async function prewarm() {
     () => module.preloadSessionRuntimeModule?.(),
     () => module.preloadAgentLoopRuntime?.(),
     () => module.preloadKeychainSecrets?.(),
-    () => module.preloadProviderRuntime?.(),
     () => module.preloadMemoryRuntime?.(),
   ].map((start) => Promise.resolve().then(start)));
   return { ready: true };
@@ -185,14 +153,42 @@ async function workloadSnapshot() {
     import('../runtime/shared/tool-workload-gates.mjs'),
     import('../runtime/shared/resource-admission.mjs'),
   ]);
+  const memory = process.memoryUsage();
   return {
     runtimes: records.size,
+    memory: {
+      rssBytes: memory.rss,
+      heapTotalBytes: memory.heapTotal,
+      heapUsedBytes: memory.heapUsed,
+      externalBytes: memory.external,
+      arrayBufferBytes: memory.arrayBuffers,
+    },
     childSpawns: gate.snapshot(),
     toolIo: workload.toolWorkloadSnapshot(),
     resources: resources.resourceAdmission.snapshot(),
   };
 }
 
+// Accepted user input lives in the pending-message spool until its write
+// settles. Exiting on top of an in-flight write silently loses it, so every
+// exit path drains the spool first (bounded; a stuck write must not wedge
+// shutdown).
+async function exitAfterPendingWrites(code = 0) {
+  try {
+    const pendingMessages = await import(
+      '../runtime/agent/orchestrator/session/manager/pending-messages.mjs'
+    );
+    await pendingMessages.settlePendingMessageWrites?.({ timeoutMs: 1_500 });
+  } catch (error) {
+    try {
+      process.stderr.write(
+        `[session-runtime-worker] pending message drain failed: ${error?.message || error}\n`,
+      );
+    } catch {}
+  }
+  process.exit(code);
+}
+
 async function stopAll(reason = 'session runtime worker shutdown') {
   if (stopping) return;
   stopping = true;
@@ -231,20 +227,19 @@ process.on('message', (message) => {
     throw new Error(`unknown session runtime message ${message.type}`);
   })().then((value) => {
     if (requestId) send({ type: 'response', requestId, ok: true, value: value ?? null });
-    if (message.type === 'call' && unhealthyDetail && !unhealthyReported) {
-      unhealthyReported = true;
-      send({ type: 'unhealthy', detail: unhealthyDetail });
-    }
-    if (message.type === 'shutdown') setImmediate(() => process.exit(0));
+    reportUnhealthy();
+    if (message.type === 'shutdown') setImmediate(() => { void exitAfterPendingWrites(0); });
   }).catch((error) => {
     if (requestId) send({ type: 'response', requestId, ok: false, error: errorBody(error) });
+    reportUnhealthy();
   });
 });
 
 process.on('disconnect', () => {
-  void stopAll('session runtime parent disconnected').finally(() => process.exit(0));
+  void stopAll('session runtime parent disconnected')
+    .finally(() => exitAfterPendingWrites(0));
 });
 
 process.on('SIGTERM', () => {
-  void stopAll('session runtime SIGTERM').finally(() => process.exit(0));
+  void stopAll('session runtime SIGTERM').finally(() => exitAfterPendingWrites(0));
 });

package/src/standalone/session-service.mjs

@@ -318,7 +318,10 @@ export function createSessionService({
     // so identity is a sound cache key. Without this the whole transcript was
     // re-sanitized on every call AND every published frame.
     if (raw && entry.snapshotSource === raw) return entry.snapshotCache;
-    const cloned = projectState(entry, raw);
+    // Runtime-worker IPC has already produced a wire-safe graph. Reusing it
+    // removes the daemon's second full transcript clone; in-process runtimes
+    // keep the sanitizer boundary below.
+    const cloned = entry.runtime?.isWireSafe === true ? raw : projectState(entry, raw);
     entry.snapshotSource = raw;
     entry.snapshotCache = cloned;
     return cloned;