mixdog 0.9.16 → 0.9.18

package/src/runtime/channels/lib/output-forwarder.mjs

@@ -28,8 +28,24 @@ import {
   buildToolLine
 } from "./tool-format.mjs";
 
+// Per-item send watchdog. drainQueue awaits ONE backend send at a time; a hung
+// send would otherwise never settle, so drainQueue never returns and `sending`
+// stays true forever — wedging ALL outbound behind the queue head. The watchdog
+// does NOT abandon the send (racing a still-running send against a retry would
+// double-deliver): it only pokes the backend to reset its wedged client so the
+// AWAITED send fails fast and `sending` releases on real settlement. Sized above
+// the backend's worst-case per-attempt retries.
+const SEND_ITEM_TIMEOUT_MS = 120_000;
+// After the watchdog resets the backend, wait at most this long for the
+// abandoned send to actually settle before releasing the queue.
+const SEND_SETTLE_CAP_MS = 15_000;
+const TAIL_RECOVERY_BYTES = 256 * 1024;
+
 class OutputForwarder {
   ownerGetter = null;
+  // Generation of the in-flight supervised send. Bumped when a send is
+  // abandoned (settlement cap) so a late/zombie completion can't double-advance.
+  _activeSendGen = 0;
   setOwnerGetter(fn) {
     this.ownerGetter = fn;
   }
@@ -111,20 +127,35 @@ class OutputForwarder {
     try {
       const stat = existsSync(this.transcriptPath) ? statSync(this.transcriptPath) : null;
       const currentSize = stat?.size ?? 0;
+      const persisted = this.statusState?.read?.();
+      const sameTranscript = persisted?.transcriptPath &&
+        sameResolvedPath(persisted.transcriptPath, this.transcriptPath);
       let fileSize;
       if (options.replayFromStart) {
         fileSize = 0;
       } else if (options.catchUpFromPersisted) {
-        const persisted = this.statusState?.read?.();
         const persistedSize = typeof persisted?.lastFileSize === "number" ? persisted.lastFileSize : -1;
-        const sameTranscript = persisted?.transcriptPath &&
-          sameResolvedPath(persisted.transcriptPath, this.transcriptPath);
         fileSize = (sameTranscript && persistedSize >= 0)
           ? Math.min(Math.max(persistedSize, 0), currentSize)
           : currentSize;
       } else {
         fileSize = currentSize;
       }
+      if (options.recoverUnsyncedTail && fileSize === currentSize && currentSize > 0) {
+        const sentCount = Number(persisted?.sentCount ?? 0);
+        const lastSentTime = Number(persisted?.lastSentTime ?? 0);
+        const hasSentHash = typeof persisted?.lastSentHash === "string" && persisted.lastSentHash.length > 0;
+        const noSendEvidence = (!Number.isFinite(sentCount) || sentCount <= 0)
+          && (!Number.isFinite(lastSentTime) || lastSentTime <= 0)
+          && !hasSentHash;
+        if (!sameTranscript || noSendEvidence) {
+          const tailOffset = this.findLastAssistantTextOffset(currentSize);
+          if (tailOffset >= 0 && tailOffset < currentSize) {
+            fileSize = tailOffset;
+            dropTrace("context.recoverUnsyncedTail", { path: this.transcriptPath, offset: tailOffset, currentSize, sameTranscript: !!sameTranscript });
+          }
+        }
+      }
       this.lastFileSize = fileSize;
       this.readFileSize = fileSize;
     } catch {
@@ -132,6 +163,46 @@ class OutputForwarder {
       this.readFileSize = 0;
     }
   }
+  findLastAssistantTextOffset(fileSize) {
+    if (!this.transcriptPath || fileSize <= 0) return -1;
+    const bytesToRead = Math.min(fileSize, TAIL_RECOVERY_BYTES);
+    const startOffset = fileSize - bytesToRead;
+    let fd = null;
+    try {
+      fd = openSync(this.transcriptPath, "r");
+      const buf = Buffer.alloc(bytesToRead);
+      readSync(fd, buf, 0, bytesToRead, startOffset);
+      const raw = buf.toString("utf8");
+      let chunkStart = 0;
+      if (startOffset > 0) {
+        const firstNewline = raw.indexOf("\n");
+        if (firstNewline < 0) return -1;
+        chunkStart = firstNewline + 1;
+      }
+      let cursor = startOffset + chunkStart;
+      let lastOffset = -1;
+      for (const line of raw.slice(chunkStart).split("\n")) {
+        const lineOffset = cursor;
+        cursor += Buffer.byteLength(line, "utf8") + 1;
+        if (!line.trim()) continue;
+        try {
+          const entry = JSON.parse(line);
+          if (entry.isSidechain || entry.type !== "assistant") continue;
+          const parts = entry.message?.content;
+          if (!Array.isArray(parts)) continue;
+          if (parts.some((c) => c?.type === "text" && typeof c.text === "string" && c.text.trim())) {
+            lastOffset = lineOffset;
+          }
+        } catch {
+        }
+      }
+      return lastOffset;
+    } catch {
+      return -1;
+    } finally {
+      if (fd != null) closeSync(fd);
+    }
+  }
   /** Reset counters for new turn */
   reset() {
     this.sentCount = 0;
@@ -282,6 +353,7 @@ class OutputForwarder {
   }
   async deliverQueueItem(item) {
     const targetChannelId = item.channelId ?? this.channelId;
+    const gen = ++this._activeSendGen;
     if (!item.text || !targetChannelId) {
       this.commitReadProgress(item.nextFileSize);
       return;
@@ -314,10 +386,13 @@ class OutputForwarder {
       // re-sending chunks that already landed. The token is opaque here —
       // the forwarder only stores/passes/clears it, never interprets it.
       await this.cb.send(targetChannelId, formatted, item._resumeToken ? { resumeToken: item._resumeToken } : undefined);
+      dropTrace("discord.send.ok", null);
+      // A zombie completion (send abandoned past the settlement cap, gen bumped)
+      // must not mutate ANY item/queue state — including the resume token.
+      if (gen !== this._activeSendGen) return;
       // Full success — drop any stale token so a later reuse of this item
       // object can't carry a dead token.
       item._resumeToken = undefined;
-      dropTrace("discord.send.ok", null);
     } catch (err) {
       // Persist the opaque resume token (if any) on the item so the requeued
       // retry resumes from the failed chunk.
@@ -349,7 +424,18 @@ ${_bt.trim()}` : _bt.trim();
   }
   /** Forward new assistant text to Discord. Returns true if text was sent. */
   async forwardNewText() {
-    if (!this._isOwner()) return false;
+    if (!this._isOwner()) {
+      // Silent no-send is invisible and has masked real ownership-gate bugs
+      // (a live seat that never forwards). Surface it, rate-limited to one
+      // line per 60s so a persistent non-owner state stays visible without
+      // flooding stderr on every poll tick.
+      const now = Date.now();
+      if (!this._lastOwnerGateLogAt || now - this._lastOwnerGateLogAt >= 60_000) {
+        this._lastOwnerGateLogAt = now;
+        process.stderr.write(`[output-forwarder] forwardNewText skipped: not seat owner (channelId=${this.channelId ?? "none"})\n`);
+      }
+      return false;
+    }
     if (!this.channelId) return false;
     const { text: newText, nextFileSize } = this.extractNewText();
     if (!newText) {
@@ -428,6 +514,31 @@ ${_bt.trim()}` : _bt.trim();
   _kickDrain() {
     this.drainQueue().catch(err => process.stderr.write(`[output-forwarder] drainQueue rejected: ${err?.message || err}\n`));
   }
+  /** Supervise a per-item send. The underlying promise is AWAITED to real
+   *  settlement so `sending` is never released early (no unsupervised send
+   *  racing a retry → duplicate). The watchdog's only job is to reset the
+   *  backend's wedged client so the awaited send fails fast. */
+  _sendSupervised(promise, label) {
+    const settled = Promise.resolve(promise);
+    settled.catch(() => {}); // never leak an unhandled rejection on late settle
+    return new Promise((resolve, reject) => {
+      let capTimer = null;
+      const watchdog = setTimeout(() => {
+        process.stderr.write(`[output-forwarder] ${label} watchdog fired after ${SEND_ITEM_TIMEOUT_MS}ms; resetting backend\n`);
+        Promise.resolve(this.cb?.resetBackend?.()).catch(() => {});
+        // Bound the post-reset settlement wait; past the cap, invalidate the
+        // in-flight send (gen bump → zombie can't double-advance) and release.
+        capTimer = setTimeout(() => {
+          this._activeSendGen++;
+          reject(new Error(`${label} abandoned after ${SEND_SETTLE_CAP_MS}ms settlement cap`));
+        }, SEND_SETTLE_CAP_MS);
+      }, SEND_ITEM_TIMEOUT_MS);
+      settled.then(
+        (v) => { clearTimeout(watchdog); if (capTimer) clearTimeout(capTimer); resolve(v); },
+        (e) => { clearTimeout(watchdog); if (capTimer) clearTimeout(capTimer); reject(e); }
+      );
+    });
+  }
   /** Drain both priority lanes sequentially. finalLane drains first when non-empty. */
   async drainQueue() {
     if (this.sending) return;
@@ -440,9 +551,9 @@ ${_bt.trim()}` : _bt.trim();
         const item = lane[0];
         try {
           if (item.type === "text") {
-            await this.deliverQueueItem(item);
+            await this._sendSupervised(this.deliverQueueItem(item), "deliverQueueItem");
           } else if (item.type === "toolLog") {
-            await this.processToolLog(item);
+            await this._sendSupervised(this.processToolLog(item), "processToolLog");
           }
           lane.shift();
         } catch (err) {

package/src/runtime/channels/lib/runtime-paths.mjs

@@ -38,17 +38,6 @@ function parsePositivePid(value) {
 function getTerminalLeadPid() {
   return parsePositivePid(process.env.MIXDOG_SUPERVISOR_PID) ?? process.pid;
 }
-// Pinned-owner default: ON. The first session to claim ownership auto-pins
-// itself and keeps the seat until its PID dies. Opt out per session with
-// MIXDOG_PIN_OWNER=0 (or false/no/off) when you want the legacy 10 s stale-
-// window takeover behavior — e.g. throwaway shells that should never become
-// the sticky main.
-function isOwnerPinEnabled() {
-  const v = process.env.MIXDOG_PIN_OWNER;
-  if (v === undefined || v === null || v === "") return true;
-  const low = String(v).toLowerCase();
-  return !(low === "0" || low === "false" || low === "no" || low === "off");
-}
 function getServerPid() {
   return parsePositivePid(process.env.MIXDOG_SERVER_PID) ?? (process.env.MIXDOG_WORKER_MODE === "1" ? null : process.pid);
 }
@@ -104,8 +93,10 @@ function touchUiHeartbeat(instanceId) {
       if (!curRaw) return undefined;
       if (instanceId && curRaw.instanceId !== instanceId) return undefined;
       return { ...curRaw, ui_heartbeat_at: Date.now(), updatedAt: Date.now() };
-    }, { compact: true, fsync: false, fsyncDir: false, renameFallback: 'truncate' });
-  } catch { /* best-effort; a missed tick just relies on the next one */ }
+    }, { compact: true, fsync: false, fsyncDir: false, renameFallback: 'truncate', timeoutMs: 0 });
+  } catch { /* best-effort try-once (timeoutMs:0): on lock contention we skip
+               this tick without ever blocking the render loop on Atomics.wait;
+               the next 30s tick catches up. */ }
 }
 function buildRuntimeIdentity() {
   const terminalLeadPid = getTerminalLeadPid();
@@ -294,12 +285,10 @@ function refreshActiveInstance(instanceId, meta, options) {
         if (outBase !== newBase) next.priorTranscriptPath = outgoing;
       }
     }
-    // Pinned ownership (default ON): each refresh reasserts the pinned flag
-    // from the current process's env. Other processes refreshing carry their
-    // own env, so the flag never outlives the pinned process. Set
-    // MIXDOG_PIN_OWNER=0 to opt out and revert to stale-window takeover.
-    if (isOwnerPinEnabled()) next.pinned = true;
-    else delete next.pinned;
+    // Ownership is strict last-wins (no pin): the newest claim always takes
+    // the seat. Drop any legacy `pinned` flag left by older versions — it was
+    // written but never consumed by any takeover check.
+    delete next.pinned;
     // I1: pg_* spreads FIRST so newFields above win on conflict.
     // prev.pg_port='A', meta.httpPort-adjacent pg_port='B' → result.pg_port='B'.
     // memory_port: preserve when the advertising memory worker is still alive
@@ -371,6 +360,19 @@ function refreshActiveInstance(instanceId, meta, options) {
         }
       }
     }
+    // Worker-owned seat: when THIS process is the channels worker and it is
+    // the seat owner (no distinct TUI/supervisor Lead — ownerLeadPid resolves
+    // to our own pid), keep ui_heartbeat_at fresh. A headless worker never
+    // runs the TUI render loop, so an inherited heartbeat (written by a prior
+    // TUI session and carried forward in prevRest) would otherwise go stale at
+    // UI_HEARTBEAT_STALE_MS and falsely flag a live worker-owned seat. A
+    // TUI-owned seat has a distinct supervisor (ownerLeadPid !== our pid), so
+    // this branch is a no-op there and TUI staleness is preserved.
+    const workerOwnsSeat = process.env.MIXDOG_WORKER_MODE === "1"
+      && identity.ownerLeadPid === process.pid;
+    if (workerOwnsSeat) {
+      next.ui_heartbeat_at = Date.now();
+    }
     return { ...preservedExtra, ...next };
   }, { compact: true, fsync: false, fsyncDir: false, renameFallback: 'truncate' });
 }

package/src/runtime/channels/lib/voice-transcription.mjs

@@ -167,9 +167,11 @@ function createVoiceTranscription({ getConfig, dataDir }) {
       if (attachmentId && result) _voiceTranscriptCache.set(attachmentId, result);
       return result;
     } catch (err) {
-      if (err?.message?.startsWith('voice runtime not installed')) throw err; // propagate setup errors; caller posts user-visible failure
+      // Propagate ALL real failures so the caller's retry (network-class) and
+      // failure marker (index.mjs catch) fire; null is reserved strictly for a
+      // legit empty transcript.
       process.stderr.write(`mixdog: voice.transcription failed: ${err}\n`);
-      return null;
+      throw err;
     }
   }
 

package/src/runtime/memory/index.mjs

@@ -10,6 +10,7 @@ process.on('warning', () => {})
 
 import http from 'node:http'
 import os from 'node:os'
+import { performance } from 'node:perf_hooks'
 import fs from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath, pathToFileURL } from 'node:url'
@@ -102,6 +103,17 @@ if (!DATA_DIR) {
   process.exit(1)
 }
 __mixdogMemoryLog(`[memory-service] DATA_DIR=${DATA_DIR}\n`)
+const MEMORY_PROFILE_ENABLED = /^(1|true|yes|on)$/i.test(String(process.env.MIXDOG_MEMORY_PROFILE || process.env.MIXDOG_BOOT_PROFILE || ''))
+const MEMORY_PROFILE_START = performance.now()
+function memoryProfile(event, fields = {}) {
+  if (!MEMORY_PROFILE_ENABLED) return
+  const parts = [`[memory-profile] +${(performance.now() - MEMORY_PROFILE_START).toFixed(1)}ms`, event]
+  for (const [key, value] of Object.entries(fields || {})) {
+    if (value === undefined || value === null || value === '') continue
+    parts.push(`${key}=${String(value).replace(/\s+/g, '_')}`)
+  }
+  __mixdogMemoryLog(`${parts.join(' ')}\n`)
+}
 
 import {
   parsePositivePid,
@@ -283,6 +295,7 @@ function _ingestIdentityFields(m) {
   _ingestIdentityFieldsCache.set(m, fields)
   return fields
 }
+
 // Ingest now WAITS for its embedding flush (bounded) so freshly ingested rows
 // are dense-searchable the moment ingest_session returns. On a cold ONNX
 // model the flush can stall on warmup; the race below caps the wait and lets
@@ -339,6 +352,8 @@ function assertSecondaryPgAttachable() {
 }
 
 async function _initStore() {
+  const initStoreStartedAt = performance.now()
+  memoryProfile('init-store:start')
   mainConfig = readMainConfig()
   const embeddingConfig = mainConfig?.embedding
   if (embeddingConfig?.provider || embeddingConfig?.ollamaModel || embeddingConfig?.dtype) {
@@ -380,17 +395,24 @@ async function _initStore() {
   if (dimsResolved) {
     primeEmbeddingDims(dimsResolved)
     assertSecondaryPgAttachable()
+    const openStartedAt = performance.now()
     db = await openDatabase(DATA_DIR, dimsResolved)
+    memoryProfile('open-db:done', { ms: (performance.now() - openStartedAt).toFixed(1), dims: dimsResolved })
     _embeddingWarmup.schedule(EMBEDDING_META_PATH, metaKey)
   } else {
     if (!embeddingWarmupCanStart()) {
       throw new Error('memory-service: embedding dims unavailable while warmup is disabled')
     }
     // Cold path: meta missed AND model not registered. Sequential.
+    const warmupStartedAt = performance.now()
+    memoryProfile('embedding:cold-warmup:start')
     await warmupEmbeddingProvider()
+    memoryProfile('embedding:cold-warmup:done', { ms: (performance.now() - warmupStartedAt).toFixed(1) })
     dimsResolved = Number(getEmbeddingDims())
     assertSecondaryPgAttachable()
+    const openStartedAt = performance.now()
     db = await openDatabase(DATA_DIR, dimsResolved)
+    memoryProfile('open-db:done', { ms: (performance.now() - openStartedAt).toFixed(1), dims: dimsResolved })
     try {
       writeJsonAtomicSync(EMBEDDING_META_PATH, { ...metaKey, dims: dimsResolved }, { lock: true })
     } catch (e) {
@@ -429,13 +451,18 @@ async function _initStore() {
   if (cyclesCapable || memoryLlmWorkerEnabled()) {
     try {
       const agentCfg = loadAgentConfig()
+      const providersStartedAt = performance.now()
       await initProviders(agentCfg.providers || {})
+      memoryProfile('providers:init:done', { ms: (performance.now() - providersStartedAt).toFixed(1) })
     } catch (e) {
       process.stderr.write(`[memory-service] initProviders failed (non-fatal): ${e instanceof Error ? e.message : String(e)}\n`)
     }
   }
   _bootTimestamp = Date.now()
+  const offsetsStartedAt = performance.now()
   await loadTranscriptOffsets()
+  memoryProfile('transcript-offsets:loaded', { ms: (performance.now() - offsetsStartedAt).toFixed(1) })
+  memoryProfile('init-store:done', { ms: (performance.now() - initStoreStartedAt).toFixed(1) })
 }
 
 async function getCycleLastRun() {
@@ -679,11 +706,16 @@ function _stopCycles() {
 
 async function _initRuntime() {
   if (_initialized) return
+  const runtimeStartedAt = performance.now()
+  memoryProfile('runtime-init:start')
   await _initStore()
+  memoryProfile('runtime-init:init-store-ready', { ms: (performance.now() - runtimeStartedAt).toFixed(1) })
   // Restore the core_entries.id == 1..N invariant once per boot: SERIAL only
   // increments, so deleted rows leave permanent gaps. Fast no-op when already
   // contiguous (or empty). Runs only here — never in cycle2/addCore/deleteCore.
+  const compactStartedAt = performance.now()
   await compactCoreIds(DATA_DIR)
+  memoryProfile('core-ids:compact:done', { ms: (performance.now() - compactStartedAt).toFixed(1) })
   // Memory module is always-on: the transcript watcher/ingest runs
   // unconditionally except in secondary mode (secondary attaches to a primary's
   // PG and must not double-ingest). The recap toggle only gates whether the
@@ -697,7 +729,9 @@ async function _initRuntime() {
     __mixdogMemoryLog('[memory-service] secondary mode; skipping transcript watcher\n')
   }
   if (!memorySecondaryMode() && !envFlagEnabled('MIXDOG_MEMORY_DISABLE_CYCLES')) {
+    const cyclesStartedAt = performance.now()
     _startCycles()
+    memoryProfile('cycles:start:done', { ms: (performance.now() - cyclesStartedAt).toFixed(1) })
   } else {
     __mixdogMemoryLog('[memory-service] background cycle tick loop not started (secondary/env-disabled)\n')
   }
@@ -705,6 +739,7 @@ async function _initRuntime() {
   // Boot complete — continue straight into the deferred embedding warmup.
   // Fire-and-forget on the embedding worker thread; never awaited so it does
   // not delay init() returning or the memory-ready signal.
+  memoryProfile('embedding:warmup:fire')
   _embeddingWarmup.fireDeferred()
   // Boot-edge Korean morph warmup. Same fire-and-forget style: lazy async init
   // downloads+caches the Kiwi model once under DATA_DIR/kiwi-model/<version>,
@@ -712,8 +747,10 @@ async function _initRuntime() {
   // buildFtsQuery keeps the websearch_to_tsquery fallback (never throws here).
   // Skipped in secondary mode (query path lives on the primary).
   if (!memorySecondaryMode()) {
+    memoryProfile('ko-morph:warmup:fire')
     initKoMorph(DATA_DIR, __mixdogMemoryLog).catch(() => {})
   }
+  memoryProfile('runtime-init:done', { ms: (performance.now() - runtimeStartedAt).toFixed(1) })
 }
 
 function _beginRuntimeInit() {

package/src/runtime/memory/lib/embedding-warmup.mjs

@@ -28,8 +28,11 @@ export function createEmbeddingWarmup({
       return
     }
     _pending = () => {
+      const startedAt = Date.now()
+      log('[memory-service] embedding warmup start\n')
       warmup()
         .then(() => {
+          log(`[memory-service] embedding warmup ready in ${Date.now() - startedAt}ms\n`)
           const measured = Number(getDims())
           try {
             persistMeta(metaPath, { ...metaKey, dims: measured })

package/src/runtime/memory/lib/ko-morph.mjs

@@ -130,6 +130,7 @@ export async function init(dataDir, log = () => {}) {
   _log = typeof log === 'function' ? log : (() => {})
   _state = 'loading'
   const t0 = Date.now()
+  _log(`[memory-service] kiwi morph init start (model ${KIWI_MODEL_VERSION})\n`)
   _initPromise = (async () => {
     // Resolve the WASM path from the installed package without hard-importing
     // (keeps the whole feature optional if kiwi-nlp isn't installed).

package/src/runtime/shared/atomic-file.mjs

@@ -63,6 +63,16 @@ export function withFileLockSync(lockPath, fn, opts = {}) {
     } catch (err) {
       lastErr = err;
       if (!LOCK_WAIT_CODES.has(err?.code)) throw err;
+      // try-once semantics: timeoutMs:0 makes a single openSync attempt and
+      // never sleeps — on contention it throws ELOCKCONTENDED immediately so
+      // the main loop is never blocked by Atomics.wait. No stale-reclaim,
+      // since reclaim would require waiting on the guard.
+      if (timeoutMs <= 0) {
+        const contErr = new Error(`atomic lock contended (try-once): ${lockPath}`);
+        contErr.code = 'ELOCKCONTENDED';
+        contErr.cause = err;
+        throw contErr;
+      }
       try {
         const st = statSync(lockPath);
         if (Date.now() - st.mtimeMs > staleMs) {
@@ -246,6 +256,86 @@ function _releaseReclaimGuard(reclaim) {
   }
 }
 
+// ── Async lock variant (non-blocking wait) ──────────────────────────
+// Identical lock protocol to withFileLockSync (same lockPath, same pid
+// stamp, same stale/ownership/reclaim rules) so a sync holder and an
+// async holder are mutually exclusive against one another — they contend
+// for the SAME openSync('wx') on the SAME path. The ONLY difference is
+// the wait: instead of Atomics.wait blocking the event loop, we yield via
+// setTimeout backoff. Intended for UI-process consistency-required writes
+// that must not stall the render loop.
+function _asyncSleep(ms) {
+  return new Promise((resolve) => { setTimeout(resolve, Math.max(1, Number(ms) || 1)); });
+}
+
+export async function withFileLock(lockPath, fn, opts = {}) {
+  const timeoutMs = Number.isFinite(opts.timeoutMs) ? opts.timeoutMs : DEFAULT_LOCK_TIMEOUT_MS;
+  const staleMs = Number.isFinite(opts.staleMs) ? opts.staleMs : 30000;
+  const deadline = Date.now() + timeoutMs;
+  mkdirSync(dirname(lockPath), { recursive: true });
+  let attempt = 0;
+  let lastErr = null;
+  while (true) {
+    let fd;
+    try {
+      fd = openSync(lockPath, 'wx');
+    } catch (err) {
+      lastErr = err;
+      if (!LOCK_WAIT_CODES.has(err?.code)) throw err;
+      if (timeoutMs <= 0) {
+        const contErr = new Error(`atomic lock contended (try-once): ${lockPath}`);
+        contErr.code = 'ELOCKCONTENDED';
+        contErr.cause = err;
+        throw contErr;
+      }
+      try {
+        const st = statSync(lockPath);
+        if (Date.now() - st.mtimeMs > staleMs) {
+          const deadPid = _readLockOwnerPid(lockPath);
+          if (deadPid !== null && _pidIsDead(deadPid)) {
+            const reclaim = _tryAcquireReclaimGuard(lockPath, staleMs);
+            if (reclaim !== null) {
+              let reclaimed = false;
+              try {
+                const currentSt = statSync(lockPath);
+                if (Date.now() - currentSt.mtimeMs > staleMs) {
+                  const currentPid = _readLockOwnerPid(lockPath);
+                  if (currentPid === deadPid && _pidIsDead(currentPid)) {
+                    try { unlinkSync(lockPath); reclaimed = true; } catch {}
+                  }
+                }
+              } finally {
+                _releaseReclaimGuard(reclaim);
+              }
+              if (reclaimed) continue;
+            }
+          }
+        }
+      } catch {}
+      if (Date.now() >= deadline) break;
+      const base = DEFAULT_BACKOFFS_MS[Math.min(attempt, DEFAULT_BACKOFFS_MS.length - 1)];
+      const jitter = Math.floor(Math.random() * Math.min(75, Math.max(1, base)));
+      await _asyncSleep(Math.min(Math.max(1, deadline - Date.now()), base + jitter));
+      attempt += 1;
+      continue;
+    }
+    try { writeFileSync(fd, `${process.pid} ${Date.now()}\n`, 'utf8'); } catch {}
+    try {
+      if (opts.secret === true) _enforceOwnerOnlyAclWin32(lockPath);
+      return await fn();
+    } finally {
+      try { closeSync(fd); } catch {}
+      try {
+        if (_lockOwnedByPid(lockPath, process.pid)) unlinkSync(lockPath);
+      } catch {}
+    }
+  }
+  const timeoutErr = new Error(`atomic lock timeout after ${timeoutMs}ms: ${lockPath}`);
+  timeoutErr.code = 'ELOCKTIMEOUT';
+  timeoutErr.cause = lastErr;
+  throw timeoutErr;
+}
+
 // ── Windows owner-only ACL enforcement (fail-closed) ─────────────────
 // POSIX 0o600/0o700 mode bits are advisory-at-best on Windows: NTFS
 // ignores them and the file inherits the parent ACL, which in shared or
@@ -459,3 +549,23 @@ export function updateJsonAtomicSync(filePath, mutator, opts = {}) {
     return next;
   }, opts);
 }
+
+// Async read-modify-write. Same lock path (`${filePath}.lock`) and protocol
+// as updateJsonAtomicSync, so it is mutually exclusive with the sync variant.
+// The critical section itself is synchronous (readFileSync + writeJsonAtomicSync);
+// only the lock WAIT is async, so the event loop is never blocked on contention.
+export async function updateJsonAtomic(filePath, mutator, opts = {}) {
+  const { lock: _lock, ...writeOpts } = opts;
+  return withFileLock(`${filePath}.lock`, () => {
+    let cur = null;
+    try {
+      cur = JSON.parse(readFileSync(filePath, 'utf8'));
+    } catch {
+      cur = null;
+    }
+    const next = mutator(cur);
+    if (next === undefined) return cur;
+    writeJsonAtomicSync(filePath, next, { ...writeOpts, lock: false });
+    return next;
+  }, opts);
+}

package/src/runtime/shared/transcript-writer.mjs

@@ -15,6 +15,13 @@
  * cannot spam the terminal.
  */
 import { existsSync, mkdirSync, renameSync, statSync, writeFileSync } from 'node:fs';
+
+// After this many appended bytes since the last rotation stat, re-check
+// disk size via statSync. Bounds the sync-fs cost per append to roughly
+// once every ~64KB of transcript growth instead of on every single line,
+// while still catching rotation promptly (a JSONL line is typically well
+// under 1KB, so this is on the order of dozens of appends between stats).
+const ROTATE_CHECK_BYTE_STRIDE = 64 * 1024;
 import { dirname, join, resolve } from 'node:path';
 import { appendBuffered, drainPathSync, hasInFlightWrite } from './buffered-appender.mjs';
 
@@ -62,10 +69,28 @@ export function createTranscriptWriter({ mixdogHome, sessionId, cwd, pid } = {})
     }
   }
 
-  function rotateIfNeeded() {
+  // Local byte counter tracking growth since the last real statSync, so
+  // rotateIfNeeded's fs work is O(1) per append instead of an existsSync+
+  // statSync pair on every single JSONL line (this fires on every assistant
+  // chunk / tool call, i.e. per token-stream event, not per turn). We only
+  // hit disk again once the locally-tracked size estimate could plausibly
+  // have crossed the rotate threshold, or a full check hasn't happened yet.
+  let sizeChecked = false;
+  let lastKnownSize = 0;
+  let bytesSinceCheck = 0;
+
+  function statAndMaybeRotate() {
     try {
-      if (!existsSync(transcriptPath)) return;
+      if (!existsSync(transcriptPath)) {
+        sizeChecked = true;
+        lastKnownSize = 0;
+        bytesSinceCheck = 0;
+        return;
+      }
       const { size } = statSync(transcriptPath);
+      sizeChecked = true;
+      lastKnownSize = size;
+      bytesSinceCheck = 0;
       if (size < TRANSCRIPT_ROTATE_BYTES) return;
       // An async appendFile may be in flight for this path; renaming out
       // from under it races the write on Windows. Skip this round and
@@ -76,17 +101,34 @@ export function createTranscriptWriter({ mixdogHome, sessionId, cwd, pid } = {})
       // file post-rename doesn't inherit stale in-memory chunks.
       drainPathSync(transcriptPath);
       const rotatedPath = `${transcriptPath}.1`;
-      try { renameSync(transcriptPath, rotatedPath); } catch (err) { logOnce(err); }
+      try {
+        renameSync(transcriptPath, rotatedPath);
+        lastKnownSize = 0;
+      } catch (err) { logOnce(err); }
     } catch (err) {
       logOnce(err);
     }
   }
 
+  function rotateIfNeeded() {
+    // Real stat only when: no check has happened yet, the locally-tracked
+    // growth alone could have crossed the rotate threshold, or the last
+    // known size plus tracked growth is already at/over the threshold
+    // (catches a file that was already large when this process attached).
+    if (!sizeChecked
+      || bytesSinceCheck >= ROTATE_CHECK_BYTE_STRIDE
+      || lastKnownSize + bytesSinceCheck >= TRANSCRIPT_ROTATE_BYTES) {
+      statAndMaybeRotate();
+    }
+  }
+
   function appendLine(entry) {
     ensureProjectDir();
     rotateIfNeeded();
     try {
-      appendBuffered(transcriptPath, `${JSON.stringify(entry)}\n`);
+      const line = `${JSON.stringify(entry)}\n`;
+      appendBuffered(transcriptPath, line);
+      bytesSinceCheck += Buffer.byteLength(line);
     } catch (err) {
       logOnce(err);
     }