mixdog 0.9.174 → 1.0.0

package/src/runtime/agent/orchestrator/session/send-instrumentation.mjs

@@ -0,0 +1,194 @@
+// Per-send callback instrumentation for sendWithRecovery: bench-only turn
+// timing, the loop-side exposure witness and the retry-visibility relay. The
+// wrappers are installed on the caller's opts in place for ONE send, and the
+// returned restore unwinds only our own wrappers.
+import { isVisibleStreamProgress } from '../../../shared/stream-progress.mjs';
+
+// Bench-only turn timing (MIXDOG_TURN_TIMING=1): one stderr line per
+// provider request — TTFT (first visible model progress) and total stream
+// time. Transport/header and response-created acknowledgements do not count.
+// Inert unless the env flag is set; used to profile harness vs model
+// latency in Terminal-Bench runs.
+function beginTurnTiming(opts, model) {
+  const turnT0 = process.env.MIXDOG_TURN_TIMING === '1' ? Date.now() : 0;
+  if (!turnT0) return { timedOpts: opts, log() {} };
+  let turnFirstDelta = 0;
+  const prevDelta = typeof opts?.onStreamDelta === 'function' ? opts.onStreamDelta : null;
+  const timedOpts = {
+    ...(opts || {}),
+    onStreamDelta: (kind) => {
+      if (!turnFirstDelta && isVisibleStreamProgress(kind)) turnFirstDelta = Date.now();
+      if (prevDelta) prevDelta(kind);
+    },
+  };
+  return {
+    timedOpts,
+    log(status) {
+      const now = Date.now();
+      const ttft = turnFirstDelta ? turnFirstDelta - turnT0 : -1;
+      try {
+        console.error(`[turn-timing] status=${status} ttft=${ttft}ms total=${now - turnT0}ms model=${model}`);
+      } catch {
+        /* logging must never break the send path */
+      }
+    },
+  };
+}
+
+// Retry visibility (reference parity). codex surfaces EVERY stream retry to
+// the front-end ("Reconnecting... n/max") precisely so a replayed request
+// cannot read as ordinary thinking; gemini-cli requires an onRetry hook for
+// the same reason. Emitting the reconnect stage only for the backoff wait
+// let the replayed send report plain 'requesting'/'streaming' again, so
+// three stalled retries rendered as ~20 minutes of a normal spinner with
+// nothing to explain it. Hold the reconnect stage across the whole replay
+// until THIS attempt shows visible progress: the replacement stream's first
+// visible delta ends the reconnect display, and from that point the turn is
+// healthy and must read as a normal response.
+function retryVisibilityWrappers(opts, timedOpts, retryAttemptNumber, retryMaxForDisplay) {
+  const prevOnStageChange = typeof opts?.onStageChange === 'function' ? opts.onStageChange : null;
+  const prevOptsOnStreamDelta = typeof opts?.onStreamDelta === 'function' ? opts.onStreamDelta : null;
+  const retryDeltaBase = timedOpts || opts;
+  const prevOnStreamDeltaForRetry =
+    typeof retryDeltaBase?.onStreamDelta === 'function' ? retryDeltaBase.onStreamDelta : null;
+  const wrappers = {
+    onStageChange: null,
+    onStreamDelta: null,
+    prevOnStageChange,
+    prevOptsOnStreamDelta,
+    prevOnStreamDeltaForRetry,
+  };
+  if (!(retryAttemptNumber > 0 && prevOnStageChange)) return wrappers;
+  let progressObserved = false;
+  wrappers.onStageChange = (stage, detail) => {
+    if (!progressObserved && (stage === 'requesting' || stage === 'streaming')) {
+      return prevOnStageChange('reconnecting', {
+        ...(detail && typeof detail === 'object' ? detail : {}),
+        attempt: retryAttemptNumber,
+        max: retryMaxForDisplay,
+        message: `Reconnecting... ${retryAttemptNumber}/${retryMaxForDisplay}`,
+      });
+    }
+    return prevOnStageChange(stage, detail);
+  };
+  wrappers.onStreamDelta = (kind, ...rest) => {
+    if (!progressObserved && isVisibleStreamProgress(kind)) {
+      progressObserved = true;
+      try {
+        prevOnStageChange('streaming', { recoveredAfterRetry: retryAttemptNumber });
+      } catch {
+        /* display-only */
+      }
+    }
+    return prevOnStreamDeltaForRetry?.(kind, ...rest);
+  };
+  return wrappers;
+}
+
+// Wraps the caller's stream callbacks in place for ONE send — bench-only
+// turn timing, the loop-side exposure witness and the retry-visibility
+// relay — and hands back the restore that unwinds only our own wrappers.
+export function instrumentSendCallbacks(opts, { model, retryAttemptNumber, retryMaxForDisplay }) {
+  const timing = beginTurnTiming(opts, model);
+  const { timedOpts } = timing;
+  // Loop-side exposure witness. Some providers throw truncation/stall
+  // errors that carry only partialContent — neither liveTextEmitted nor
+  // unsafeToRetry — so an outcome read from the ERROR alone can report
+  // replaySafe even though this very send already relayed text to the
+  // client through opts.onTextDelta, or dispatched a tool call through
+  // opts.onToolCall. Replaying such a send would duplicate output the user
+  // already saw (or re-run a side effect), so record what THIS send
+  // actually exposed and merge it into every outcome read. The callbacks
+  // are wrapped in place and restored conditionally: the overflow-retry
+  // branch intentionally clears opts.onToolCall, and that clear must
+  // survive the restore.
+  const witness = relayWitnessWrappers(opts);
+  const retry = retryVisibilityWrappers(opts, timedOpts, retryAttemptNumber, retryMaxForDisplay);
+  const install = (target) => {
+    if (witness.onTextDelta) target.onTextDelta = witness.onTextDelta;
+    if (witness.onToolCall) target.onToolCall = witness.onToolCall;
+    if (witness.onTextReset) target.onTextReset = witness.onTextReset;
+    if (retry.onStageChange) target.onStageChange = retry.onStageChange;
+    if (retry.onStreamDelta) target.onStreamDelta = retry.onStreamDelta;
+  };
+  if (opts) install(opts);
+  if (timedOpts !== opts && timedOpts) install(timedOpts);
+  return {
+    timedOpts,
+    relayWitness: witness.relayWitness,
+    logTurnTiming: timing.log,
+    restore: () => restoreSendCallbacks(opts, timedOpts, witness, retry),
+  };
+}
+
+// Wraps opts.onTextDelta / opts.onToolCall / opts.onTextReset so the witness
+// records what this send actually put on screen and dispatched: the relayed
+// text net of acknowledged retractions (a provider's own non-streaming
+// fallback retracts through the same callback), and the ids of dispatched
+// calls. Null wrappers where the caller subscribed to nothing.
+function relayWitnessWrappers(opts) {
+  const relayWitness = { textEmitted: false, text: '', toolCallsDispatched: 0, dispatchedToolCallIds: new Set() };
+  const prevOnTextDelta = typeof opts?.onTextDelta === 'function' ? opts.onTextDelta : null;
+  const prevOnToolCall = typeof opts?.onToolCall === 'function' ? opts.onToolCall : null;
+  const prevOnTextReset = typeof opts?.onTextReset === 'function' ? opts.onTextReset : null;
+  const onTextDelta = prevOnTextDelta
+    ? (...args) => {
+        if (typeof args[0] === 'string' && args[0].length > 0) {
+          relayWitness.textEmitted = true;
+          relayWitness.text += args[0];
+        }
+        return prevOnTextDelta(...args);
+      }
+    : null;
+  const onToolCall = prevOnToolCall
+    ? (...args) => {
+        relayWitness.toolCallsDispatched += 1;
+        if (args[0]?.id) relayWitness.dispatchedToolCallIds.add(String(args[0].id));
+        return prevOnToolCall(...args);
+      }
+    : null;
+  const onTextReset = prevOnTextReset
+    ? async (...args) => {
+        const acked = await prevOnTextReset(...args);
+        if (acked === true) {
+          const kept = relayWitness.text.length - Math.max(0, Number(args[0]?.chars) || 0);
+          relayWitness.text = relayWitness.text.slice(0, Math.max(0, kept));
+          if (!relayWitness.text) relayWitness.textEmitted = false;
+        }
+        return acked;
+      }
+    : null;
+  return {
+    relayWitness,
+    onTextDelta,
+    onToolCall,
+    onTextReset,
+    prevOnTextDelta,
+    prevOnToolCall,
+    prevOnTextReset,
+  };
+}
+
+// Conditional restore: only unwind our own wrappers. An intentional
+// opts.onToolCall = undefined (overflow-retry branch) stays cleared.
+function restoreSendCallbacks(opts, timedOpts, witness, retry) {
+  if (opts) {
+    if (witness.onTextDelta && opts.onTextDelta === witness.onTextDelta) opts.onTextDelta = witness.prevOnTextDelta;
+    if (witness.onToolCall && opts.onToolCall === witness.onToolCall) opts.onToolCall = witness.prevOnToolCall;
+    if (witness.onTextReset && opts.onTextReset === witness.onTextReset) opts.onTextReset = witness.prevOnTextReset;
+    if (retry.onStageChange && opts.onStageChange === retry.onStageChange) {
+      opts.onStageChange = retry.prevOnStageChange;
+    }
+    if (retry.onStreamDelta && opts.onStreamDelta === retry.onStreamDelta) {
+      opts.onStreamDelta = retry.prevOptsOnStreamDelta;
+    }
+  }
+  if (timedOpts && timedOpts !== opts) {
+    if (retry.onStageChange && timedOpts.onStageChange === retry.onStageChange) {
+      timedOpts.onStageChange = retry.prevOnStageChange;
+    }
+    if (retry.onStreamDelta && timedOpts.onStreamDelta === retry.onStreamDelta) {
+      timedOpts.onStreamDelta = retry.prevOnStreamDeltaForRetry;
+    }
+  }
+}

package/src/runtime/agent/orchestrator/session/send-with-recovery.mjs

@@ -39,7 +39,7 @@ import { resolveWorkerCompactPolicy } from './loop/compact-policy.mjs';
 import { agentContextOverflowError } from './loop/context-overflow.mjs';
 import { estimateMessagesTokensSafe } from './loop/compact-debug.mjs';
 import { isOutputLimitStopReason } from './loop/termination.mjs';
-import { isVisibleStreamProgress } from '../../../shared/stream-progress.mjs';
+import { instrumentSendCallbacks } from './send-instrumentation.mjs';
 
 function normalizedIncompleteUsage(raw) {
   if (!raw || typeof raw !== 'object') return undefined;
@@ -119,20 +119,17 @@ const CONNECTION_RETRY_BACKOFF_MS = retryLadderFromEnv('MIXDOG_CONNECTION_RETRY_
 // cycles, and each cycle re-enters the provider's ordinary retries (reference:
 // bounded post-exhaustion auto-recovery on a jittered 15/30/60/60/60 s
 // schedule).
-const RECOVERY_RETRY_BACKOFF_MS = retryLadderFromEnv('MIXDOG_RECOVERY_RETRY_BACKOFF_MS', [
-  15_000,
-  30_000,
-  60_000,
-  60_000,
-  60_000,
-]);
+const RECOVERY_RETRY_BACKOFF_MS = retryLadderFromEnv(
+  'MIXDOG_RECOVERY_RETRY_BACKOFF_MS',
+  [15_000, 30_000, 60_000, 60_000, 60_000]
+);
 
 // A server-advised wait (Retry-After) replaces the ladder step: a provider that
 // names its own cooldown knows better, within reason — one loop-level wait
 // never parks longer than this.
 const LOOP_RETRY_AFTER_CAP_MS = 120_000;
 
-// Jittering every backoff by 0.9–1.1 keeps parallel workers that lose the
+// Jittering every backoff by 0.9–1.1 means parallel workers that lose the
 // same uplink do not resume in lockstep; our provider layers already jitter
 // (10% WS / 20% shared), this brings the loop ladder in line.
 const TRANSPORT_RETRY_JITTER_RATIO = 0.1;
@@ -234,195 +231,6 @@ export async function sendWithRecovery(ctx) {
   }
 }
 
-// Bench-only turn timing (MIXDOG_TURN_TIMING=1): one stderr line per
-// provider request — TTFT (first visible model progress) and total stream
-// time. Transport/header and response-created acknowledgements do not count.
-// Inert unless the env flag is set; used to profile harness vs model
-// latency in Terminal-Bench runs.
-function beginTurnTiming(opts, model) {
-  const turnT0 = process.env.MIXDOG_TURN_TIMING === '1' ? Date.now() : 0;
-  if (!turnT0) return { timedOpts: opts, log() {} };
-  let turnFirstDelta = 0;
-  const prevDelta = typeof opts?.onStreamDelta === 'function' ? opts.onStreamDelta : null;
-  const timedOpts = {
-    ...(opts || {}),
-    onStreamDelta: (kind) => {
-      if (!turnFirstDelta && isVisibleStreamProgress(kind)) turnFirstDelta = Date.now();
-      if (prevDelta) prevDelta(kind);
-    },
-  };
-  return {
-    timedOpts,
-    log(status) {
-      const now = Date.now();
-      const ttft = turnFirstDelta ? turnFirstDelta - turnT0 : -1;
-      try {
-        console.error(`[turn-timing] status=${status} ttft=${ttft}ms total=${now - turnT0}ms model=${model}`);
-      } catch {
-        /* logging must never break the send path */
-      }
-    },
-  };
-}
-
-// Retry visibility (reference parity). codex surfaces EVERY stream retry to
-// the front-end ("Reconnecting... n/max") precisely so a replayed request
-// cannot read as ordinary thinking; gemini-cli requires an onRetry hook for
-// the same reason. Emitting the reconnect stage only for the backoff wait
-// let the replayed send report plain 'requesting'/'streaming' again, so
-// three stalled retries rendered as ~20 minutes of a normal spinner with
-// nothing to explain it. Hold the reconnect stage across the whole replay
-// until THIS attempt shows visible progress: the replacement stream's first
-// visible delta ends the reconnect display, and from that point the turn is
-// healthy and must read as a normal response.
-function retryVisibilityWrappers(opts, timedOpts, retryAttemptNumber, retryMaxForDisplay) {
-  const prevOnStageChange = typeof opts?.onStageChange === 'function' ? opts.onStageChange : null;
-  const prevOptsOnStreamDelta = typeof opts?.onStreamDelta === 'function' ? opts.onStreamDelta : null;
-  const retryDeltaBase = timedOpts || opts;
-  const prevOnStreamDeltaForRetry =
-    typeof retryDeltaBase?.onStreamDelta === 'function' ? retryDeltaBase.onStreamDelta : null;
-  const wrappers = {
-    onStageChange: null,
-    onStreamDelta: null,
-    prevOnStageChange,
-    prevOptsOnStreamDelta,
-    prevOnStreamDeltaForRetry,
-  };
-  if (!(retryAttemptNumber > 0 && prevOnStageChange)) return wrappers;
-  let progressObserved = false;
-  wrappers.onStageChange = (stage, detail) => {
-    if (!progressObserved && (stage === 'requesting' || stage === 'streaming')) {
-      return prevOnStageChange('reconnecting', {
-        ...(detail && typeof detail === 'object' ? detail : {}),
-        attempt: retryAttemptNumber,
-        max: retryMaxForDisplay,
-        message: `Reconnecting... ${retryAttemptNumber}/${retryMaxForDisplay}`,
-      });
-    }
-    return prevOnStageChange(stage, detail);
-  };
-  wrappers.onStreamDelta = (kind, ...rest) => {
-    if (!progressObserved && isVisibleStreamProgress(kind)) {
-      progressObserved = true;
-      try {
-        prevOnStageChange('streaming', { recoveredAfterRetry: retryAttemptNumber });
-      } catch {
-        /* display-only */
-      }
-    }
-    return prevOnStreamDeltaForRetry?.(kind, ...rest);
-  };
-  return wrappers;
-}
-
-// Wraps the caller's stream callbacks in place for ONE send — bench-only
-// turn timing, the loop-side exposure witness and the retry-visibility
-// relay — and hands back the restore that unwinds only our own wrappers.
-function instrumentSendCallbacks(opts, { model, retryAttemptNumber, retryMaxForDisplay }) {
-  const timing = beginTurnTiming(opts, model);
-  const { timedOpts } = timing;
-  // Loop-side exposure witness. Some providers throw truncation/stall
-  // errors that carry only partialContent — neither liveTextEmitted nor
-  // unsafeToRetry — so an outcome read from the ERROR alone can report
-  // replaySafe even though this very send already relayed text to the
-  // client through opts.onTextDelta, or dispatched a tool call through
-  // opts.onToolCall. Replaying such a send would duplicate output the user
-  // already saw (or re-run a side effect), so record what THIS send
-  // actually exposed and merge it into every outcome read. The callbacks
-  // are wrapped in place and restored conditionally: the overflow-retry
-  // branch intentionally clears opts.onToolCall, and that clear must
-  // survive the restore.
-  const witness = relayWitnessWrappers(opts);
-  const retry = retryVisibilityWrappers(opts, timedOpts, retryAttemptNumber, retryMaxForDisplay);
-  const install = (target) => {
-    if (witness.onTextDelta) target.onTextDelta = witness.onTextDelta;
-    if (witness.onToolCall) target.onToolCall = witness.onToolCall;
-    if (witness.onTextReset) target.onTextReset = witness.onTextReset;
-    if (retry.onStageChange) target.onStageChange = retry.onStageChange;
-    if (retry.onStreamDelta) target.onStreamDelta = retry.onStreamDelta;
-  };
-  if (opts) install(opts);
-  if (timedOpts !== opts && timedOpts) install(timedOpts);
-  return {
-    timedOpts,
-    relayWitness: witness.relayWitness,
-    logTurnTiming: timing.log,
-    restore: () => restoreSendCallbacks(opts, timedOpts, witness, retry),
-  };
-}
-
-// Wraps opts.onTextDelta / opts.onToolCall / opts.onTextReset so the witness
-// records what this send actually put on screen and dispatched: the relayed
-// text net of acknowledged retractions (a provider's own non-streaming
-// fallback retracts through the same callback), and the ids of dispatched
-// calls. Null wrappers where the caller subscribed to nothing.
-function relayWitnessWrappers(opts) {
-  const relayWitness = { textEmitted: false, text: '', toolCallsDispatched: 0, dispatchedToolCallIds: new Set() };
-  const prevOnTextDelta = typeof opts?.onTextDelta === 'function' ? opts.onTextDelta : null;
-  const prevOnToolCall = typeof opts?.onToolCall === 'function' ? opts.onToolCall : null;
-  const prevOnTextReset = typeof opts?.onTextReset === 'function' ? opts.onTextReset : null;
-  const onTextDelta = prevOnTextDelta
-    ? (...args) => {
-        if (typeof args[0] === 'string' && args[0].length > 0) {
-          relayWitness.textEmitted = true;
-          relayWitness.text += args[0];
-        }
-        return prevOnTextDelta(...args);
-      }
-    : null;
-  const onToolCall = prevOnToolCall
-    ? (...args) => {
-        relayWitness.toolCallsDispatched += 1;
-        if (args[0]?.id) relayWitness.dispatchedToolCallIds.add(String(args[0].id));
-        return prevOnToolCall(...args);
-      }
-    : null;
-  const onTextReset = prevOnTextReset
-    ? async (...args) => {
-        const acked = await prevOnTextReset(...args);
-        if (acked === true) {
-          const kept = relayWitness.text.length - Math.max(0, Number(args[0]?.chars) || 0);
-          relayWitness.text = relayWitness.text.slice(0, Math.max(0, kept));
-          if (!relayWitness.text) relayWitness.textEmitted = false;
-        }
-        return acked;
-      }
-    : null;
-  return {
-    relayWitness,
-    onTextDelta,
-    onToolCall,
-    onTextReset,
-    prevOnTextDelta,
-    prevOnToolCall,
-    prevOnTextReset,
-  };
-}
-
-// Conditional restore: only unwind our own wrappers. An intentional
-// opts.onToolCall = undefined (overflow-retry branch) stays cleared.
-function restoreSendCallbacks(opts, timedOpts, witness, retry) {
-  if (opts) {
-    if (witness.onTextDelta && opts.onTextDelta === witness.onTextDelta) opts.onTextDelta = witness.prevOnTextDelta;
-    if (witness.onToolCall && opts.onToolCall === witness.onToolCall) opts.onToolCall = witness.prevOnToolCall;
-    if (witness.onTextReset && opts.onTextReset === witness.onTextReset) opts.onTextReset = witness.prevOnTextReset;
-    if (retry.onStageChange && opts.onStageChange === retry.onStageChange) {
-      opts.onStageChange = retry.prevOnStageChange;
-    }
-    if (retry.onStreamDelta && opts.onStreamDelta === retry.onStreamDelta) {
-      opts.onStreamDelta = retry.prevOptsOnStreamDelta;
-    }
-  }
-  if (timedOpts && timedOpts !== opts) {
-    if (retry.onStageChange && timedOpts.onStageChange === retry.onStageChange) {
-      timedOpts.onStageChange = retry.prevOnStageChange;
-    }
-    if (retry.onStreamDelta && timedOpts.onStreamDelta === retry.onStreamDelta) {
-      timedOpts.onStreamDelta = retry.prevOnStreamDeltaForRetry;
-    }
-  }
-}
-
 function loopTag({ sessionId, nextIteration }) {
   return `sess=${sessionId || 'unknown'} iter=${nextIteration}`;
 }

package/src/runtime/agent/orchestrator/session/store/canonical-reader.mjs

@@ -343,13 +343,6 @@ export function createCanonicalSessionReader({
   };
   return Object.assign(read, {
     forget,
-    /**
-     * A strict parse another reader already made of bytes it proved to
-     * belong to `stamp` (stat → read → stat, unchanged): cached exactly as
-     * this reader's own lifecycle reads are — settled stamps only, reused
-     * only while the full stamp is unchanged. Own-commit-only checks never
-     * consult it.
-     */
     /**
      * A lifecycle barrier this realm just renamed into place. Barrier
      * rewrites are deliberately NOT own commits (write authority re-reads
@@ -375,6 +368,13 @@ export function createCanonicalSessionReader({
       }
       remember(target, stamp, lifecycle);
     },
+    /**
+     * A strict parse another reader already made of bytes it proved to
+     * belong to `stamp` (stat → read → stat, unchanged): cached exactly as
+     * this reader's own lifecycle reads are — settled stamps only, reused
+     * only while the full stamp is unchanged. Own-commit-only checks never
+     * consult it.
+     */
     rememberStrictVerdict(target, stamp, record) {
       if (!stamp || isLifecycleUnreadable(record) || !settledStamp(stamp, nowNs())) return;
       remember(target, stamp, Object.freeze({ id: record.id, closed: record.closed, generation: record.generation }));

package/src/runtime/agent/orchestrator/session/store/fs-probe.mjs

@@ -20,23 +20,6 @@ const PROBE_UNREADABLE = 'unreadable';
 // session load path uses).
 const ABSENT_CODES = new Set(['ENOENT', 'ENOTDIR']);
 
-// Deterministic fault seam (tests only): invoked with the path before every
-// stat and every read (`phase` is 'stat' or 'read'); returning an Error makes
-// that syscall fail. Structurally gated — without the explicit test-mode env
-// the hook cannot be installed and an already installed one goes inert.
-const PROBE_FAULT_ENV = 'MIXDOG_SESSION_LOAD_FAULT_HOOKS';
-let _probeFaultHook = null;
-
-function _probeFault(path, phase) {
-  if (!_probeFaultHook) return;
-  if (process.env[PROBE_FAULT_ENV] !== '1') {
-    _probeFaultHook = null; // gate revoked after install: stay inert
-    return;
-  }
-  const injected = _probeFaultHook(path, phase);
-  if (injected instanceof Error) throw injected;
-}
-
 // The absent/unreadable verdict for a failed stat or read.
 function _failureVerdict(err) {
   const code = err?.code || 'EUNKNOWN';
@@ -49,7 +32,6 @@ function _failureVerdict(err) {
  */
 export function probePath(path) {
   try {
-    _probeFault(path, 'stat');
     const info = statSync(path);
     return {
       state: PROBE_PRESENT,
@@ -75,7 +57,6 @@ export function probePath(path) {
  */
 export function readTextFile(path) {
   try {
-    _probeFault(path, 'read');
     return { state: PROBE_PRESENT, text: readFileSync(path, 'utf8'), code: null };
   } catch (err) {
     const { state, code } = _failureVerdict(err);

package/src/runtime/agent/orchestrator/session/store/lifecycle-barriers.mjs

@@ -5,11 +5,12 @@
  * they bypass the save queue entirely — that is why they live apart from the
  * write pipeline — and both fence late saves through the generation counter.
  */
-import { appendFileSync, writeFileSync } from 'node:fs';
+import { writeFileSync } from 'node:fs';
 import { randomBytes } from 'node:crypto';
 import { join } from 'node:path';
 import { getPluginData } from '../../config.mjs';
-import { rotateBoundedLog, PLUGIN_LOG_MAX_BYTES, PLUGIN_LOG_KEEP_BYTES } from '../../../../../lib/mixdog-debug.cjs';
+import { PLUGIN_LOG_MAX_BYTES, PLUGIN_LOG_KEEP_BYTES } from '../../../../../lib/mixdog-debug.cjs';
+import { createAsyncLogAppender } from '../../../../shared/async-log-appender.mjs';
 import { sessionPath, deleteHeartbeat } from './paths-heartbeat.mjs';
 import {
   readCanonicalSessionRecord as _readCanonicalRecord,
@@ -130,6 +131,13 @@ function _writeLifecycleRecord(id, record, existing, reason) {
 // funnels through markSessionClosed. lifeMs = updatedAt-createdAt straddles
 // the tombstone (updatedAt was just set to Date.now()), so it reflects the
 // session's full lifetime including the close turn.
+const closeMetricLog = createAsyncLogAppender({ maxBytes: PLUGIN_LOG_MAX_BYTES, keepBytes: PLUGIN_LOG_KEEP_BYTES });
+
+/** Resolves once every queued session-close metric line is written. */
+export function flushSessionCloseMetrics() {
+  return closeMetricLog.flush();
+}
+
 function _logSessionCloseMetric(id, existing, closedAt, reason) {
   try {
     const dataDir = getPluginData();
@@ -138,12 +146,11 @@ function _logSessionCloseMetric(id, existing, closedAt, reason) {
     const lifeMs = typeof existing.createdAt === 'number' && existing.createdAt > 0 ? closedAt - existing.createdAt : 0;
     const agent = existing.agent || '-';
     const owner = existing.owner || '-';
-    const toolEventsPath = join(dataDir, 'tool-events.log');
-    rotateBoundedLog(toolEventsPath, PLUGIN_LOG_MAX_BYTES, PLUGIN_LOG_KEEP_BYTES);
-    // Appended before the close returns: an untracked async append kept
-    // writing into the data dir after its caller was told the close was done.
-    appendFileSync(
-      toolEventsPath,
+    // Queued, not written inline: a close must not pay a stat + append (and
+    // an occasional rewrite) on the caller's thread. `flushSessionCloseMetrics`
+    // lets a caller that tears the data dir down wait for the write.
+    closeMetricLog.append(
+      join(dataDir, 'tool-events.log'),
       `[${ts}] [session-close] owner=${owner} agent=${agent} reason=${reason} lifeMs=${lifeMs} id=${id}\n`
     );
   } catch {

package/src/runtime/agent/orchestrator/session/store/listing.mjs

@@ -1,8 +1,8 @@
-// Session listing, summary projection and stale-session sweeping; store.mjs
-// owns the persistence half (save/load/close/delete). The two halves share
-// the in-flight save map so an unpersisted session still shows up in
-// listings; the cycle is import-only (calls happen at runtime).
-import { readFileSync, readdirSync, statSync } from 'node:fs';
+// Session listing and summary projection (the stale-session sweep is
+// sweep/stale-sweep.mjs); store.mjs owns the persistence half
+// (save/load/close/delete). Both read the in-flight save maps so an
+// unpersisted session still shows up in listings.
+import { readFileSync, readdirSync } from 'node:fs';
 import { Worker } from 'node:worker_threads';
 import { getPluginData } from '../../config.mjs';
 import { getStoreDir } from './paths-heartbeat.mjs';
@@ -17,6 +17,7 @@ import {
   _hasUnsettledSummaryOps,
   settleSummaryIndexWrites,
 } from '../store-summary-index.mjs';
+import { applySummaryLogText, readSummaryLogText, summaryIndexStampMs } from '../store-summary-log.mjs';
 import {
   _ensureSummaryCacheDataDir,
   _cachedSummaryRows,
@@ -27,7 +28,7 @@ import {
 } from './summary-cache.mjs';
 import { _saveAsyncQueued, _saveWorkerPending } from './save-worker.mjs';
 import { STORED_SESSION_UNREADABLE, _ensureLifecycleFields, _storedSessionFromFile } from './serialize.mjs';
-import { _savePending } from '../store.mjs';
+import { _savePending } from './pending-saves.mjs';
 import { isOrdinarySession } from '../store-summary-visibility.mjs';
 
 // Disk mtime of the summary index when the in-memory cache was last refreshed
@@ -36,10 +37,6 @@ let _summaryIndexMtimeSeen = 0;
 let _summaryRebuildWorker = null;
 let _summaryRebuildDataDir = '';
 
-// The stale-session sweep lives in store/sweep/ and is re-exported below so
-// importers keep this module as the listing entry point.
-export { sweepStaleSessions, sweepStaleSessionsCooperative } from './sweep/stale-sweep.mjs';
-
 export function listStoredSessions(options = {}) {
   const dir = getStoreDir();
   // Only ENOENT/ENOTDIR is absence. An unreadable directory (EACCES/EIO) is
@@ -138,11 +135,7 @@ function scheduleSessionSummaryIndexRebuild() {
   };
   worker.on('message', (message) => {
     if (message?.ok !== true || message.dataDir !== getPluginData() || !Array.isArray(message.rows)) return;
-    try {
-      _summaryIndexMtimeSeen = statSync(summaryIndexPath()).mtimeMs || 0;
-    } catch {
-      /* stat only */
-    }
+    _summaryIndexMtimeSeen = summaryIndexStampMs(summaryIndexPath());
     _setSummaryRowsCache(message.rows);
   });
   worker.on('error', clear);
@@ -217,15 +210,13 @@ function _warmSummaryRows() {
   // never fired for terminal-owned growth). One stat per call; when the
   // index advanced, re-read the cheap index JSON as the new cache base
   // (local optimistic overlays stay applied on top).
-  let diskMtime = 0;
-  try {
-    diskMtime = statSync(summaryIndexPath()).mtimeMs || 0;
-  } catch {
-    /* no index yet */
-  }
+  // Stamp = newest mtime of base + delta log, taken BEFORE the reads so a
+  // change landing mid-read is seen again on the next call.
+  const diskMtime = summaryIndexStampMs(summaryIndexPath());
   if (diskMtime <= _summaryIndexMtimeSeen) return _cachedSummaryRows().slice();
   try {
-    const raw = JSON.parse(readFileSync(summaryIndexPath(), 'utf-8'));
+    const logText = readSummaryLogText(summaryIndexPath());
+    const raw = applySummaryLogText(JSON.parse(readFileSync(summaryIndexPath(), 'utf-8')), logText);
     if (Number(raw?.version) === SESSION_SUMMARY_INDEX_VERSION) {
       _summaryIndexMtimeSeen = diskMtime;
       return _setSummaryRowsCache(_normalizeSummaryIndex(raw).rows).slice();
@@ -247,6 +238,8 @@ function _coldSummaryRows() {
     hasIndex = probe.state === PROBE_PRESENT;
     if (probe.state !== PROBE_PRESENT && probe.state !== PROBE_ABSENT) indexUnreadable = true;
     if (hasIndex) {
+      const stampBeforeRead = summaryIndexStampMs(p);
+      const logText = readSummaryLogText(p);
       let text;
       try {
         text = readFileSync(p, 'utf-8');
@@ -259,15 +252,11 @@ function _coldSummaryRows() {
         if (code !== 'ENOENT' && code !== 'ENOTDIR') indexUnreadable = true;
         throw err;
       }
-      const raw = JSON.parse(text);
+      const raw = applySummaryLogText(JSON.parse(text), logText);
       hasIndex = Number(raw?.version) === SESSION_SUMMARY_INDEX_VERSION;
-      if (hasIndex) indexedRows = _normalizeSummaryIndex(raw).rows;
       if (hasIndex) {
-        try {
-          _summaryIndexMtimeSeen = statSync(p).mtimeMs || 0;
-        } catch {
-          /* stat only */
-        }
+        indexedRows = _normalizeSummaryIndex(raw).rows;
+        _summaryIndexMtimeSeen = stampBeforeRead;
       }
     }
   } catch {