mixdog 0.9.16 → 0.9.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.16",
+  "version": "0.9.18",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",
@@ -46,6 +46,7 @@
     "smoke:freevars": "node scripts/freevar-smoke.mjs",
     "test:toolcall": "node --test scripts/toolcall-args-test.mjs",
     "test:providers": "node --test scripts/provider-toolcall-test.mjs",
+    "test:atomiclock": "node --test scripts/atomic-lock-tryonce-test.mjs",
     "failures": "node scripts/tool-failures.mjs",
     "trace:llm": "node scripts/llm-trace-summary.mjs",
     "diag:sessions": "node scripts/session-diag.mjs",

package/scripts/atomic-lock-tryonce-test.mjs

@@ -0,0 +1,66 @@
+// Proves try-once (timeoutMs:0) lock behavior: when the lock is already held,
+// withFileLockSync/withFileLock return IMMEDIATELY with ELOCKCONTENDED and
+// never sleep (no Atomics.wait / setTimeout backoff). Also asserts sync+async
+// lock interop: neither can enter the critical section while the other holds.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import {
+  withFileLockSync,
+  withFileLock,
+} from '../src/runtime/shared/atomic-file.mjs';
+
+function tmpLock() {
+  const dir = mkdtempSync(join(tmpdir(), 'mixlock-'));
+  return { dir, lockPath: join(dir, 't.lock') };
+}
+
+test('try-once sync throws ELOCKCONTENDED without sleeping when held', () => {
+  const { dir, lockPath } = tmpLock();
+  try {
+    withFileLockSync(lockPath, () => {
+      const started = Date.now();
+      assert.throws(
+        () => withFileLockSync(lockPath, () => 'unreachable', { timeoutMs: 0 }),
+        (e) => e?.code === 'ELOCKCONTENDED',
+      );
+      assert.ok(Date.now() - started < 20, `try-once slept ${Date.now() - started}ms`);
+    });
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('try-once async rejects ELOCKCONTENDED without sleeping when held', async () => {
+  const { dir, lockPath } = tmpLock();
+  try {
+    await withFileLockSync(lockPath, async () => {
+      const started = Date.now();
+      await assert.rejects(
+        withFileLock(lockPath, () => 'unreachable', { timeoutMs: 0 }),
+        (e) => e?.code === 'ELOCKCONTENDED',
+      );
+      assert.ok(Date.now() - started < 20, `try-once slept ${Date.now() - started}ms`);
+    });
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('async holder blocks sync try-once, then sync acquires after release', async () => {
+  const { dir, lockPath } = tmpLock();
+  try {
+    await withFileLock(lockPath, () => {
+      assert.throws(
+        () => withFileLockSync(lockPath, () => 'unreachable', { timeoutMs: 0 }),
+        (e) => e?.code === 'ELOCKCONTENDED',
+      );
+    });
+    const val = withFileLockSync(lockPath, () => 7, { timeoutMs: 0 });
+    assert.equal(val, 7);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});

package/scripts/provider-toolcall-test.mjs

@@ -366,6 +366,81 @@ test('anthropic(-oauth): text-only stream → no toolCalls', async () => {
     assert.equal(result.content, 'hello');
 });
 
+test('anthropic(-oauth): thinking + signature deltas → ordered thinkingBlocks before tool_use', async () => {
+    const events = [
+        { type: 'message_start', message: { model: 'claude', usage: { input_tokens: 1 } } },
+        { type: 'content_block_start', index: 0, content_block: { type: 'thinking', thinking: '' } },
+        { type: 'content_block_delta', index: 0, delta: { type: 'thinking_delta', thinking: 'step ' } },
+        { type: 'content_block_delta', index: 0, delta: { type: 'thinking_delta', thinking: 'one' } },
+        { type: 'content_block_delta', index: 0, delta: { type: 'signature_delta', signature: 'sig123' } },
+        { type: 'content_block_stop', index: 0 },
+        { type: 'content_block_start', index: 1, content_block: { type: 'tool_use', id: 'toolu_9', name: 'shell' } },
+        { type: 'content_block_delta', index: 1, delta: { type: 'input_json_delta', partial_json: '{"command":"ls"}' } },
+        { type: 'content_block_stop', index: 1 },
+        { type: 'message_delta', delta: { stop_reason: 'tool_use' }, usage: { output_tokens: 1 } },
+        { type: 'message_stop' },
+    ];
+    const result = await anthropicParseSSEStream(
+        anthropicSseResponse(events),
+        null, () => {}, () => {}, () => {}, {}, null,
+    );
+    assert.equal(result.hasThinkingContent, true);
+    assert.deepEqual(result.thinkingBlocks, [
+        { type: 'thinking', thinking: 'step one', signature: 'sig123' },
+    ]);
+    assert.deepEqual(result.toolCalls, [{ id: 'toolu_9', name: 'shell', arguments: { command: 'ls' } }]);
+});
+
+test('anthropic(-oauth): signature-only block (display omitted) → empty thinking kept with signature', async () => {
+    const events = [
+        { type: 'message_start', message: { model: 'claude', usage: { input_tokens: 1 } } },
+        { type: 'content_block_start', index: 0, content_block: { type: 'thinking' } },
+        { type: 'content_block_delta', index: 0, delta: { type: 'signature_delta', signature: 'sigABC' } },
+        { type: 'content_block_stop', index: 0 },
+        { type: 'message_delta', delta: { stop_reason: 'end_turn' }, usage: { output_tokens: 1 } },
+        { type: 'message_stop' },
+    ];
+    const result = await anthropicParseSSEStream(
+        anthropicSseResponse(events),
+        null, () => {}, () => {}, () => {}, {}, null,
+    );
+    assert.deepEqual(result.thinkingBlocks, [
+        { type: 'thinking', thinking: '', signature: 'sigABC' },
+    ]);
+});
+
+test('anthropic(-oauth): redacted_thinking round-trips exactly as {type,data} (no extra fields)', async () => {
+    const events = [
+        { type: 'message_start', message: { model: 'claude', usage: { input_tokens: 1 } } },
+        { type: 'content_block_start', index: 0, content_block: { type: 'redacted_thinking', data: 'ENCRYPTED_PAYLOAD' } },
+        { type: 'content_block_stop', index: 0 },
+        { type: 'message_delta', delta: { stop_reason: 'end_turn' }, usage: { output_tokens: 1 } },
+        { type: 'message_stop' },
+    ];
+    const result = await anthropicParseSSEStream(
+        anthropicSseResponse(events),
+        null, () => {}, () => {}, () => {}, {}, null,
+    );
+    assert.deepEqual(result.thinkingBlocks, [
+        { type: 'redacted_thinking', data: 'ENCRYPTED_PAYLOAD' },
+    ]);
+});
+
+test('anthropic effort: legacy claude-3-7-sonnet gets NO adaptive thinking / effort beta', () => {
+    const model = 'claude-3-7-sonnet-20250219';
+    assert.equal(modelSupportsEffort(model), false);
+    const body = _buildRequestBodyForCacheSmoke(
+        [{ role: 'user', content: 'hi' }],
+        model,
+        [],
+        { effort: 'high' },
+    );
+    assert.equal(body.output_config, undefined);
+    // Legacy path uses the budget_tokens shape, never thinking:adaptive.
+    assert.notEqual(body.thinking?.type, 'adaptive');
+    assert.equal(shouldIncludeEffortBeta(model, { effort: 'high' }), false);
+});
+
 // --- Leaked tool-call recovery (shared parseSSEStream guard) ----------------
 // The model sometimes emits a tool call as plain text tags inside text_delta
 // instead of a native tool_use block. The guard (8th arg = known tool names)
@@ -933,7 +1008,9 @@ test('anthropic effort: sonnet-4-6 uses output_config + effort beta, not thinkin
         { effort: 'high' },
     );
     assert.deepEqual(body.output_config, { effort: 'high' });
-    assert.equal(body.thinking, undefined);
+    // Adaptive-thinking models also carry thinking:{type:'adaptive'} — the
+    // legacy budget_tokens shape 400s on these models.
+    assert.deepEqual(body.thinking, { type: 'adaptive', display: 'summarized' });
     assert.equal(shouldIncludeEffortBeta(model, { effort: 'high' }), true);
     const beta = buildAnthropicBetaHeaders({ effort: true });
     assert.ok(beta.includes(EFFORT_BETA_HEADER));
@@ -967,7 +1044,7 @@ test('anthropic effort: xhigh on opus-4-8 is a first-class level (not downgraded
         { effort: 'xhigh' },
     );
     assert.deepEqual(body.output_config, { effort: 'xhigh' });
-    assert.equal(body.thinking, undefined);
+    assert.deepEqual(body.thinking, { type: 'adaptive', display: 'summarized' });
 });
 
 test('anthropic effort: explicit thinkingBudgetTokens wins over effort', () => {

package/src/mixdog-session-runtime.mjs

@@ -1553,6 +1553,12 @@ export async function createMixdogSessionRuntime({
     // caller: the whole probe is detached, but it internally awaits readiness.
     void (async () => {
       try {
+        // Yield one event-loop tick before the heavy chain below (module
+        // resolve, daemon fork/health-poll) starts, so Ink's next render
+        // (scheduled via setImmediate/timers) and any queued keypress
+        // events get a turn first instead of being starved by this
+        // detached chain's synchronous setup work.
+        await new Promise((r) => setImmediate(r));
         const mod = await getMemoryModule();
         const started = typeof mod?.start === 'function' ? await mod.start() : null;
         const port = started?.port;
@@ -1603,6 +1609,12 @@ export async function createMixdogSessionRuntime({
     }
     bootProfile('channels:start-scheduled', { delayMs: 0, immediate: true });
     void (async () => {
+      // Yield before the createCurrentSession/transcript/fork chain below —
+      // same rationale as the memory-eager-init yield above: this detached
+      // chain runs synchronous config/fs work (createCurrentSession, backend
+      // flush, transcript writer) back-to-back, and without a tick break it
+      // can run ahead of Ink's queued render/input handling.
+      await new Promise((r) => setImmediate(r));
       // Immediate-occupancy guarantee: make sure a session + transcript
       // exist BEFORE the worker boots — a freshly-forked worker claims and
       // runs transcript discovery inside its own start(), so publishing the

package/src/runtime/agent/orchestrator/providers/anthropic-effort.mjs

@@ -43,6 +43,15 @@ function parseClaudeVersion(model) {
     if (pair) {
         return { family: pair[1], major: Number(pair[2]), minor: null };
     }
+    // Legacy naming: version comes BEFORE the family (claude-3-7-sonnet,
+    // claude-3-5-sonnet, claude-3-opus). These are manual-thinking models —
+    // parse them so isLegacyAnthropicReasoningModel excludes them instead of
+    // letting modelSupportsEffort's `startsWith('claude-')` fallthrough grant
+    // them adaptive thinking + the effort beta (a hard 400).
+    const legacy = m.match(/^claude-(\d+)-(\d+)-(haiku|sonnet|opus)/);
+    if (legacy) {
+        return { family: legacy[3], major: Number(legacy[1]), minor: Number(legacy[2]) };
+    }
     return null;
 }
 
@@ -69,7 +78,17 @@ export function modelSupportsEffort(model) {
     if (m.includes('sonnet-5') || m.includes('fable-5')) return true;
     if (/^claude-opus-4-(6|7|8)(?:$|[-@])/.test(m)) return true;
     if (/^claude-opus-5-/.test(m)) return true;
-    if (m.startsWith('claude-')) return true;
+    // Fallthrough for not-yet-enumerated modern models: only grant effort when
+    // parseClaudeVersion resolves a family with major>=4 (and not a manual-
+    // thinking legacy already excluded above). A bare `startsWith('claude-')`
+    // here would hand thinking:adaptive + the effort beta to legacy/unknown
+    // IDs (e.g. claude-3-7-sonnet) → hard 400. Unknown-shape IDs (no version
+    // parsed) fall through to false: no effort, no adaptive thinking.
+    const parsed = parseClaudeVersion(model);
+    if (parsed && (parsed.family === 'sonnet' || parsed.family === 'opus' || parsed.family === 'fable')
+        && parsed.major >= 4) {
+        return true;
+    }
     return false;
 }
 
@@ -180,6 +199,19 @@ export function applyAnthropicEffortToBody(
                 : {};
             body.output_config = { ...existing, effort: normalized };
         }
+        // Adaptive-thinking models (4.6+) require `thinking:{type:"adaptive"}`
+        // rather than the legacy budget_tokens shape — sending
+        // `thinking:{type:"enabled"}` here 400s on sonnet-5/opus-4-7/4-8.
+        // display:"summarized" keeps reasoning blocks populated (4.7+ defaults
+        // to "omitted", silently hiding reasoning text). Gated on the same
+        // modelSupportsEffort() allowlist so older models never receive it.
+        // Set unconditionally (independent of `normalized`) so effort-capable
+        // turns always carry adaptive thinking + round-trip signatures.
+        body.thinking = { type: 'adaptive', display: 'summarized' };
+        // Adaptive/4.7+ models reject any non-default sampling param with a 400.
+        delete body.temperature;
+        delete body.top_p;
+        delete body.top_k;
         return;
     }
 

package/src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs

@@ -333,6 +333,15 @@ function toAnthropicMessages(messages) {
                 content = m.assistantBlocks.slice();
             } else {
                 content = [];
+                // Adaptive-thinking round-trip: prior-turn thinking blocks are
+                // REQUIRED back, unmodified (signature intact; empty thinking
+                // field allowed), and MUST precede tool_use blocks. Emit them
+                // first, verbatim as received from the SSE parser.
+                if (Array.isArray(m.thinkingBlocks)) {
+                    for (const tb of m.thinkingBlocks) {
+                        if (tb && typeof tb === 'object') content.push(tb);
+                    }
+                }
                 if (m.content) content.push({ type: 'text', text: m.content });
                 for (const tc of m.toolCalls) {
                     content.push({

package/src/runtime/agent/orchestrator/providers/anthropic-sse.mjs

@@ -102,6 +102,11 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
     let content = '';
     let hasThinkingContent = false;
     const contentBlockTypes = new Set();
+    // Ordered extended-thinking blocks, keyed by content_block index. Each
+    // holds the accumulated thinking text + signature exactly as received so
+    // it can be round-tripped verbatim on tool-continuation turns (required
+    // back on tool_use turns; empty thinking + signature is valid).
+    const thinkingBlocks = new Map();
     let model = '';
     let toolCalls = [];
     let usage = { inputTokens: 0, outputTokens: 0, cachedTokens: 0, cacheWriteTokens: 0, raw: null };
@@ -389,6 +394,26 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
                                 inputJson: '',
                             });
                         }
+                        if (block?.type === 'thinking' || block?.type === 'redacted_thinking') {
+                            if (block.type === 'redacted_thinking') {
+                                // Redacted blocks round-trip EXACTLY as
+                                // {type:'redacted_thinking',data} — no thinking/
+                                // signature fields (the API rejects the extras).
+                                // `data` carries the opaque payload verbatim.
+                                thinkingBlocks.set(event.index, {
+                                    type: 'redacted_thinking',
+                                    data: typeof block.data === 'string' ? block.data : '',
+                                });
+                            } else {
+                                // Seed an ordered thinking block; deltas below
+                                // append text + signature into this same slot.
+                                thinkingBlocks.set(event.index, {
+                                    type: 'thinking',
+                                    thinking: typeof block.thinking === 'string' ? block.thinking : '',
+                                    signature: typeof block.signature === 'string' ? block.signature : '',
+                                });
+                            }
+                        }
                     }
 
                     if (event.type === 'content_block_delta') {
@@ -433,6 +458,21 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
                             // tool_use) can be classified by the loop as
                             // synthesis-stalled rather than silent empty.
                             hasThinkingContent = true;
+                            // Accumulate the block content in order so it can be
+                            // returned intact and round-tripped on the next turn.
+                            // A signature_delta may arrive before any thinking_delta
+                            // seeded the slot (display-omitted models emit only a
+                            // signature) — lazily create it.
+                            let tb = thinkingBlocks.get(event.index);
+                            if (!tb) {
+                                tb = { type: 'thinking', thinking: '', signature: '' };
+                                thinkingBlocks.set(event.index, tb);
+                            }
+                            if (delta.type === 'thinking_delta') {
+                                tb.thinking += delta.thinking || '';
+                            } else {
+                                tb.signature += delta.signature || '';
+                            }
                             try { onStreamDelta?.(); } catch {}
                         }
                         if (delta?.type === 'input_json_delta') {
@@ -577,6 +617,15 @@ export async function parseSSEStream(response, signal, abortStream, onStreamDelt
             stopReason,
             hasThinkingContent,
             contentBlockTypes: Array.from(contentBlockTypes),
+            // Ordered extended-thinking blocks (verbatim thinking text +
+            // signature) for round-tripping on tool-continuation turns. Emitted
+            // in content_block index order. Empty thinking + signature is a
+            // valid block (display-omitted models) and is kept intact.
+            thinkingBlocks: thinkingBlocks.size
+                ? [...thinkingBlocks.entries()]
+                    .sort((a, b) => a[0] - b[0])
+                    .map(([, b]) => b)
+                : undefined,
         };
     } finally {
         if (idleTimer) clearTimeout(idleTimer);

package/src/runtime/agent/orchestrator/providers/anthropic.mjs

@@ -337,6 +337,14 @@ function toAnthropicMessages(messages) {
                 content = m.assistantBlocks.slice();
             } else {
                 content = [];
+                // Adaptive-thinking round-trip: prior-turn thinking blocks are
+                // REQUIRED back, unmodified (signature intact; empty thinking
+                // field allowed), and MUST precede tool_use blocks.
+                if (Array.isArray(m.thinkingBlocks)) {
+                    for (const tb of m.thinkingBlocks) {
+                        if (tb && typeof tb === 'object') content.push(tb);
+                    }
+                }
                 if (m.content) content.push({ type: 'text', text: m.content });
                 for (const tc of m.toolCalls) {
                     content.push({
@@ -672,6 +680,12 @@ export class AnthropicProvider {
                 contentBlockTypes: Array.isArray(parseResult.contentBlockTypes)
                     ? parseResult.contentBlockTypes
                     : [],
+                // Round-trip adaptive-thinking blocks (verbatim thinking +
+                // signature) so the loop can store them and replay them before
+                // tool_use on the next turn. Matches anthropic-oauth's return.
+                thinkingBlocks: Array.isArray(parseResult.thinkingBlocks) && parseResult.thinkingBlocks.length
+                    ? parseResult.thinkingBlocks
+                    : undefined,
                 usage: {
                     inputTokens: input,
                     outputTokens: output,

package/src/runtime/agent/orchestrator/session/context-utils.mjs

@@ -81,6 +81,13 @@ export function messageEstimateText(m) {
         try { text += `\n${JSON.stringify(m.toolCalls)}`; }
         catch { text += `\n[${m.toolCalls.length} tool calls]`; }
     }
+    // Anthropic adaptive-thinking blocks round-trip verbatim (thinking text +
+    // signature / redacted data) and are re-sent on tool-continuation turns, so
+    // they consume real input tokens. Count them or trim/compact undercounts.
+    if (m.role === 'assistant' && Array.isArray(m.thinkingBlocks) && m.thinkingBlocks.length) {
+        try { text += `\n${JSON.stringify(m.thinkingBlocks)}`; }
+        catch { text += `\n[${m.thinkingBlocks.length} thinking blocks]`; }
+    }
     if (m.role === 'tool' && m.toolCallId) text += `\n${m.toolCallId}`;
     return text;
 }

package/src/runtime/agent/orchestrator/session/loop.mjs

@@ -1220,6 +1220,14 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             // turn). Blank it so it never accumulates as input tokens.
             content: suppressMidTurnText ? '' : (response.content || ''),
             toolCalls: compactToolCallsForHistory(calls),
+            // Anthropic adaptive thinking: prior-turn thinking blocks must be
+            // returned verbatim (signature intact; empty thinking allowed) and
+            // are REQUIRED back before tool_use blocks on tool-continuation
+            // turns. Store them so toAnthropicMessages can build assistantBlocks
+            // = [...thinking, tool_use...]. Other providers ignore this field.
+            ...(Array.isArray(response.thinkingBlocks) && response.thinkingBlocks.length
+                ? { thinkingBlocks: response.thinkingBlocks }
+                : {}),
             ...(Array.isArray(response.reasoningItems) && response.reasoningItems.length
                 ? { reasoningItems: response.reasoningItems }
                 : {}),

package/src/runtime/agent/orchestrator/session/manager/pending-messages.mjs

@@ -2,7 +2,7 @@
 // Extracted verbatim from manager.mjs (behavior-preserving).
 import { join } from 'path';
 import { resolvePluginData } from '../../../../shared/plugin-paths.mjs';
-import { updateJsonAtomicSync } from '../../../../shared/atomic-file.mjs';
+import { updateJsonAtomicSync, updateJsonAtomic } from '../../../../shared/atomic-file.mjs';
 import { promptContentText, isInternalRuntimeNotificationText } from './prompt-utils.mjs';
 import { loadSession } from '../store.mjs';
 
@@ -115,23 +115,33 @@ function persistPendingMessages(sessionId, messages) {
         .map(pendingMessageText)
         .filter(Boolean);
     if (persistedMessages.length === 0) return 0;
-    let depth = 0;
-    try {
-        updateJsonAtomicSync(pendingMessagesPath(), (raw) => {
-            const next = normalizePendingStore(raw);
-            const q = Array.isArray(next.sessions[sessionId]) ? next.sessions[sessionId] : [];
-            q.push(...persistedMessages);
-            next.sessions[sessionId] = q;
-            const now = Date.now();
-            next.updatedAt = now;
-            touchPendingSessionEntry(next, sessionId, now);
-            depth = q.length;
-            return next;
-        }, { compact: true, lock: true, mode: PENDING_MESSAGES_MODE, fsync: false });
-    } catch (err) {
-        try { process.stderr.write(`[session] pending-message persist failed sessionId=${sessionId}: ${err?.message || err}\n`); } catch {}
-    }
-    return depth;
+    // Async lock wait: this runs on the lead/TUI main process (tool-exec +
+    // steering persist). withFileLock waits off the event loop, so cross-
+    // process contention on the shared spool never freezes the renderer.
+    // Best-effort: the returned promise is fire-and-forget; depth is reported
+    // optimistically from the buffered batch length.
+    updateJsonAtomic(pendingMessagesPath(), (raw) => {
+        const next = normalizePendingStore(raw);
+        const q = Array.isArray(next.sessions[sessionId]) ? next.sessions[sessionId] : [];
+        q.push(...persistedMessages);
+        next.sessions[sessionId] = q;
+        const now = Date.now();
+        next.updatedAt = now;
+        touchPendingSessionEntry(next, sessionId, now);
+        return next;
+    }, { compact: true, lock: true, mode: PENDING_MESSAGES_MODE, fsync: false })
+        .catch((err) => {
+            try { process.stderr.write(`[session] pending-message persist failed sessionId=${sessionId}: ${err?.message || err}\n`); } catch {}
+            // Requeue on failure (lock timeout/contention): buffered messages
+            // were already cleared by the flush, so push them back so the next
+            // scheduled flush or session takeover retries instead of losing them.
+            try {
+                const q = _pendingPersistBuffers.get(sessionId) || [];
+                q.push(...persistedMessages);
+                _pendingPersistBuffers.set(sessionId, q);
+            } catch {}
+        });
+    return persistedMessages.length;
 }
 
 function flushPendingMessagePersistsSync() {
@@ -175,6 +185,10 @@ function drainPersistedPendingMessages(sessionId) {
     if (!isValidPendingSessionId(sessionId)) return [];
     let drained = [];
     try {
+        // Sync drain: called synchronously by drainPendingMessages, whose
+        // return value is spread immediately. Kept sync (updateJsonAtomicSync)
+        // so ordering/return contract is preserved; this fires only at
+        // session takeover, not on the keystroke/turn hot path.
         updateJsonAtomicSync(pendingMessagesPath(), (raw) => {
             const next = normalizePendingStore(raw);
             const q = Array.isArray(next.sessions[sessionId]) ? next.sessions[sessionId] : [];