mixdog 0.9.174 → 1.0.0

package/src/runtime/agent/orchestrator/session/store/load-cache.mjs

@@ -175,33 +175,6 @@ export function sessionLoadCacheStats() {
 // on genuine corruption instead of spinning.
 const SESSION_LOAD_STABLE_ATTEMPTS = 5;
 
-// Deterministic fault injection point (tests only): invoked immediately
-// before every stat and every read with { phase, path, attempt }. The hook
-// may mutate the file system (simulating an atomic rename landing between
-// the two syscalls) or return an Error to make that syscall fail.
-//
-// STRUCTURAL GATE: the seam is inert unless the process was started in
-// explicit fault-injection test mode. Installing a hook without the gate is
-// a no-op (returns false), and an already-installed hook is dropped the
-// moment the gate stops being set, so a production build can never activate
-// it accidentally — not via a stray import, not via a leaked reference.
-const SESSION_LOAD_FAULT_ENV = 'MIXDOG_SESSION_LOAD_FAULT_HOOKS';
-let _sessionLoadFaultHook = null;
-
-function _faultHooksEnabled() {
-  return process.env[SESSION_LOAD_FAULT_ENV] === '1';
-}
-
-function _fault(phase, path, attempt) {
-  if (!_sessionLoadFaultHook) return;
-  if (!_faultHooksEnabled()) {
-    _sessionLoadFaultHook = null; // gate revoked after install: stay inert
-    return;
-  }
-  const injected = _sessionLoadFaultHook({ phase, path, attempt });
-  if (injected instanceof Error) throw injected;
-}
-
 // Only these mean "nothing is at this path right now". Everything else
 // (EACCES, EPERM, EIO, EBUSY, EMFILE, ELOOP, unknown) means a file is very
 // likely THERE and we simply cannot look at it: that must never be reported
@@ -211,9 +184,8 @@ const ABSENT_CODES = new Set(['ENOENT', 'ENOTDIR']);
 
 // Observation states: 'present' (signature valid), 'absent' (ENOENT-class),
 // 'unreadable' (persistent/transient failure — fail closed).
-function _observe(path, attempt) {
+function _observe(path) {
   try {
-    _fault('stat', path, attempt);
     const info = statSync(path, { bigint: true });
     return {
       state: 'present',
@@ -314,13 +286,12 @@ function _releaseDocument(entry) {
 // from the observation alone — reporting {exists:true, session:null} for a
 // perfectly readable replacement is the same false corruption the retry loop
 // exists to avoid. Uncached: no identity was verified around this read.
-function _decisiveReplacementSnapshot(id, path, attempt) {
-  const observed = _observe(path, attempt);
+function _decisiveReplacementSnapshot(id, path) {
+  const observed = _observe(path);
   if (observed.state === 'absent') return { exists: false, session: null };
   if (observed.state !== 'present') return { exists: true, session: null };
   let text = null;
   try {
-    _fault('read', path, attempt);
     text = readFileSync(path, 'utf-8');
   } catch (err) {
     const code = err?.code || 'EUNKNOWN';
@@ -338,7 +309,7 @@ export function _readStoredSessionCached(id, path, { preferInMemory = null } = {
     // parsed (if its bytes are readable and ours) or reported as
     // present-but-invalid, never as absence.
     const isFinal = attempt === SESSION_LOAD_STABLE_ATTEMPTS - 1;
-    const before = _observe(path, attempt);
+    const before = _observe(path);
     last = before;
     if (before.state !== 'present') {
       // Absent: possibly the unlink → rename hole, retry.
@@ -386,7 +357,6 @@ export function _readStoredSessionCached(id, path, { preferInMemory = null } = {
     let text = null;
     let readCode = null;
     try {
-      _fault('read', path, attempt);
       text = readFileSync(path, 'utf-8');
     } catch (err) {
       readCode = err?.code || 'EUNKNOWN';
@@ -405,10 +375,10 @@ export function _readStoredSessionCached(id, path, { preferInMemory = null } = {
       last = { state: 'absent', signature: null, code: readCode };
       // On the last boundary there is no retry left: read the
       // replacement rather than classify it from a bare stat.
-      if (isFinal) return _decisiveReplacementSnapshot(id, path, attempt);
+      if (isFinal) return _decisiveReplacementSnapshot(id, path);
       continue;
     }
-    const after = _observe(path, attempt);
+    const after = _observe(path);
     if (after.state !== 'present' || after.signature !== before.signature) {
       // A rename landed around the read — these bytes may belong to a
       // different inode than `before`, so they must never be cached

package/src/runtime/agent/orchestrator/session/store/save-delta.mjs

@@ -0,0 +1,148 @@
+import { hash } from 'node:crypto';
+import { _messagesForDisk, _sessionForDisk } from './serialize.mjs';
+
+// ── Delta handoff to the save worker ─────────────────────────────────────────
+// Worker.postMessage structured-clones on the CALLER's thread, so a full-
+// transcript payload per turn cost O(whole conversation) on the engine thread.
+// Turns normally APPEND to the message list (the array is replaced but the
+// settled message objects are reused by reference), so the parent tracks the
+// exact refs last handed to the worker and, on a pure append, ships only the
+// header + projected tail — O(turn). Any prefix change (compaction, clear,
+// repair), a broken chain (failure/restart), or the periodic full resync
+// falls back to a full snapshot. Lock-free and per-id: sessions stay fully
+// parallel and the single worker's per-id FIFO preserves chain order.
+//
+// Unbounded by count (a count cap pushed every save past N concurrent
+// sessions onto the full path): an entry lives until an invalidation, a hard
+// delete or the session's runtime teardown (forgetSessionSaveBaseline).
+//
+// No deep copy of the transcript is kept here: the worker already holds the
+// sent messages. Each sent message is identified by its live reference plus a
+// fingerprint of the projection that was sent, taken once when it was first
+// sent (and again on every periodic resync). Failure evidence is rebuilt from
+// the references only while every fingerprint still matches — an in-place
+// edit since the send makes the parent's evidence unprovable, and none is
+// recorded (the worker's own reply carries the exact attempt when it can).
+const _deltaBaseline = new Map(); // id → { refs: message[], prints: (string|null)[] | null, deltasSinceFull }
+const DELTA_FULL_RESYNC_EVERY = 25;
+
+export function _invalidateDeltaBaseline(id) {
+  _deltaBaseline.delete(id);
+}
+
+/** Drop one id's baseline; true when it had one. */
+export function _dropDeltaBaseline(id) {
+  return _deltaBaseline.delete(id);
+}
+
+export function _clearDeltaBaselines() {
+  _deltaBaseline.clear();
+}
+
+/** Read-only inspector: does the parent still hold a delta baseline for `id`? */
+export function _hasSessionSaveBaseline(id) {
+  return _deltaBaseline.has(id);
+}
+
+export function _cloneOrNull(value) {
+  try {
+    return structuredClone(value);
+  } catch {
+    return null;
+  }
+}
+
+/** Fingerprint of one projected (disk-shape) message, or null when it has none. */
+function _messagePrint(message) {
+  try {
+    return hash('sha1', JSON.stringify(message) ?? 'undefined', 'base64');
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Fingerprints for `diskMessages` (the disk projection of `live`). A message
+ * whose live reference is unchanged since `prev` keeps the fingerprint taken
+ * when it was first sent; only changed/new messages are fingerprinted.
+ */
+function _printMessages(live, diskMessages, prev) {
+  const reuse = new Map();
+  if (prev?.prints) {
+    for (let index = 0; index < prev.refs.length; index += 1) reuse.set(prev.refs[index], prev.prints[index]);
+  }
+  return diskMessages.map((message, index) =>
+    reuse.has(live[index]) ? reuse.get(live[index]) : _messagePrint(message)
+  );
+}
+
+/**
+ * What one attempt sent, without copying the transcript: a detached copy of
+ * the (small) header, the live message references and their fingerprints.
+ */
+function _attemptRecord(header, refs, prints) {
+  if (!prints) return null;
+  const detached = _cloneOrNull({ ...header, messages: [] });
+  return detached ? { header: detached, refs, prints } : null;
+}
+
+/**
+ * Failure evidence for one attempt, rebuilt from its references only while
+ * every message still projects to exactly what was sent; otherwise none.
+ * (_recordSaveFailure detaches whatever it keeps.)
+ */
+export function _attemptEvidence(attempt) {
+  if (!attempt) return null;
+  const messages = _messagesForDisk(attempt.refs);
+  for (let index = 0; index < messages.length; index += 1) {
+    const print = attempt.prints[index];
+    if (print === null || _messagePrint(messages[index]) !== print) return null;
+  }
+  return { ...attempt.header, messages };
+}
+
+function _isPureAppend(refs, live) {
+  if (live.length < refs.length) return false;
+  for (let index = 0; index < refs.length; index += 1) {
+    if (live[index] !== refs[index]) return false;
+  }
+  return true;
+}
+
+export function _buildWirePayload(id, session, forceFull = false) {
+  const live = Array.isArray(session.messages) ? session.messages : [];
+  const base = forceFull ? null : _deltaBaseline.get(id);
+  const resyncDue = !base || base.deltasSinceFull >= DELTA_FULL_RESYNC_EVERY;
+  if (!resyncDue && _isPureAppend(base.refs, live)) {
+    // Header: full disk projection with an empty message list (strips
+    // transient aliases); tail: per-message projection of the appended
+    // suffix only. Both use the same idempotent per-message projection
+    // as a full send, so worker-side reconstruction is byte-identical.
+    const header = _sessionForDisk({ ...session, messages: [] });
+    const tailMessages = _messagesForDisk(live.slice(base.refs.length));
+    // The EXACT payload the worker will reconstruct and write is the sent
+    // baseline + this delta. Its evidence is fingerprint-checked against
+    // what was sent, never a fresh projection of the mutable live session
+    // (an in-place nested edit of an already-sent message is NOT part of a
+    // reference-identity delta). Only the tail is fingerprinted.
+    const prints = base.prints ? base.prints.concat(tailMessages.map(_messagePrint)) : null;
+    const refs = live.slice();
+    _deltaBaseline.set(id, { refs, deltasSinceFull: base.deltasSinceFull + 1, prints });
+    return {
+      delta: { baseCount: base.refs.length, header, tailMessages },
+      attempt: _attemptRecord(header, refs, prints),
+    };
+  }
+  const full = _sessionForDisk(session);
+  const diskMessages = Array.isArray(full.messages) ? full.messages : [];
+  // A prefix change (compaction, edit, repair) keeps the fingerprints of
+  // every unchanged message. The periodic resync, a forced full retry and a
+  // missing baseline re-fingerprint everything, so in-place nested edits of
+  // settled messages become provable evidence again at least every
+  // DELTA_FULL_RESYNC_EVERY saves.
+  const refs = live.slice();
+  const prints = _printMessages(live, diskMessages, resyncDue ? null : base);
+  _deltaBaseline.set(id, { refs, deltasSinceFull: 0, prints });
+  // (saveSessionAsync normalizes `messages` to an array before any post.)
+  return { session: full, attempt: _attemptRecord(full, refs, prints) };
+}

package/src/runtime/agent/orchestrator/session/store/save-fault.mjs

@@ -13,8 +13,8 @@
  *     canonical file first. There is deliberately NO env-driven fault
  *     configuration: nothing in a production environment can arm this.
  *  2. Conservative reclamation of the store's OWN abandoned scratch files.
- *     A failed commit can leave `<id>.json.<hex>.tmp` bytes behind; the store
- *     used to swallow the unlink failure and leak them forever. Only paths
+ *     A failed commit can leave `<id>.json.<hex>.tmp` bytes behind, and a
+ *     swallowed unlink failure would leak them forever. Only paths
  *     THIS realm minted and then failed to unlink are retried, and only when
  *     they match the store's exact scratch naming. The sessions directory is
  *     never scanned: an unregistered scratch file may be the save worker's or
@@ -74,7 +74,7 @@ export function _registerOrphanSaveTmp(tmp) {
 /**
  * Drop a scratch file. Retries the transient win32 codes once, and on final
  * failure registers the path so the bounded sweeper retries it later instead
- * of leaking it (the previous `catch { /* ignore *\/ }` was terminal).
+ * of leaking it.
  */
 export function _discardSaveTmp(tmp) {
   if (!tmp) return true;

package/src/runtime/agent/orchestrator/session/store/save-worker.mjs

@@ -1,7 +1,14 @@
-import { hash } from 'node:crypto';
 import { MessageChannel, Worker } from 'node:worker_threads';
 import { guardedSaveOptions as _guardedSaveOptions } from './write-guards.mjs';
-import { _ensureLifecycleFields, _messagesForDisk, _sessionForDisk } from './serialize.mjs';
+import { _ensureLifecycleFields } from './serialize.mjs';
+import {
+  _attemptEvidence,
+  _buildWirePayload,
+  _clearDeltaBaselines,
+  _cloneOrNull,
+  _dropDeltaBaseline,
+  _invalidateDeltaBaseline,
+} from './save-delta.mjs';
 import {
   setLiveSession,
   _recordSaveFailure,
@@ -46,34 +53,8 @@ let _saveWorkerRefCount = 0;
 let _deferredSaveReqId = 0;
 export const _deferredSessionSaves = new Map();
 
-// ── Delta handoff to the save worker ─────────────────────────────────────────
-// Worker.postMessage structured-clones on the CALLER's thread, so a full-
-// transcript payload per turn cost O(whole conversation) on the engine thread.
-// Turns normally APPEND to the message list (the array is replaced but the
-// settled message objects are reused by reference), so the parent tracks the
-// exact refs last handed to the worker and, on a pure append, ships only the
-// header + projected tail — O(turn). Any prefix change (compaction, clear,
-// repair), a broken chain (failure/restart), or the periodic full resync
-// falls back to a full snapshot. Lock-free and per-id: sessions stay fully
-// parallel and the single worker's per-id FIFO preserves chain order.
-//
-// Unbounded by count (a count cap pushed every save past N concurrent
-// sessions onto the full path): an entry lives until an invalidation, a hard
-// delete or the session's runtime teardown (forgetSessionSaveBaseline).
-//
-// No deep copy of the transcript is kept here: the worker already holds the
-// sent messages. Each sent message is identified by its live reference plus a
-// fingerprint of the projection that was sent, taken once when it was first
-// sent (and again on every periodic resync). Failure evidence is rebuilt from
-// the references only while every fingerprint still matches — an in-place
-// edit since the send makes the parent's evidence unprovable, and none is
-// recorded (the worker's own reply carries the exact attempt when it can).
-const _deltaBaseline = new Map(); // id → { refs: message[], prints: (string|null)[] | null, deltasSinceFull }
-const DELTA_FULL_RESYNC_EVERY = 25;
-
-function _invalidateDeltaBaseline(id) {
-  _deltaBaseline.delete(id);
-}
+// The parent-side delta baseline and wire-payload builder live in save-delta.mjs.
+export { _hasSessionSaveBaseline } from './save-delta.mjs';
 
 /**
  * Release everything the save path retains for a session that went away: the
@@ -84,7 +65,7 @@ function _invalidateDeltaBaseline(id) {
  */
 export function forgetSessionSaveBaseline(id) {
   if (!id) return false;
-  const had = _deltaBaseline.delete(id);
+  const had = _dropDeltaBaseline(id);
   if (_saveWorker) {
     try {
       _saveWorker.postMessage({ __forgetBase: String(id) });
@@ -95,114 +76,6 @@ export function forgetSessionSaveBaseline(id) {
   return had;
 }
 
-/** Read-only inspector: does the parent still hold a delta baseline for `id`? */
-export function _hasSessionSaveBaseline(id) {
-  return _deltaBaseline.has(id);
-}
-
-function _cloneOrNull(value) {
-  try {
-    return structuredClone(value);
-  } catch {
-    return null;
-  }
-}
-
-/** Fingerprint of one projected (disk-shape) message, or null when it has none. */
-function _messagePrint(message) {
-  try {
-    return hash('sha1', JSON.stringify(message) ?? 'undefined', 'base64');
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Fingerprints for `diskMessages` (the disk projection of `live`). A message
- * whose live reference is unchanged since `prev` keeps the fingerprint taken
- * when it was first sent; only changed/new messages are fingerprinted.
- */
-function _printMessages(live, diskMessages, prev) {
-  const reuse = new Map();
-  if (prev?.prints) {
-    for (let index = 0; index < prev.refs.length; index += 1) reuse.set(prev.refs[index], prev.prints[index]);
-  }
-  return diskMessages.map((message, index) =>
-    reuse.has(live[index]) ? reuse.get(live[index]) : _messagePrint(message)
-  );
-}
-
-/**
- * What one attempt sent, without copying the transcript: a detached copy of
- * the (small) header, the live message references and their fingerprints.
- */
-function _attemptRecord(header, refs, prints) {
-  if (!prints) return null;
-  const detached = _cloneOrNull({ ...header, messages: [] });
-  return detached ? { header: detached, refs, prints } : null;
-}
-
-/**
- * Failure evidence for one attempt, rebuilt from its references only while
- * every message still projects to exactly what was sent; otherwise none.
- * (_recordSaveFailure detaches whatever it keeps.)
- */
-function _attemptEvidence(attempt) {
-  if (!attempt) return null;
-  const messages = _messagesForDisk(attempt.refs);
-  for (let index = 0; index < messages.length; index += 1) {
-    const print = attempt.prints[index];
-    if (print === null || _messagePrint(messages[index]) !== print) return null;
-  }
-  return { ...attempt.header, messages };
-}
-
-function _isPureAppend(refs, live) {
-  if (live.length < refs.length) return false;
-  for (let index = 0; index < refs.length; index += 1) {
-    if (live[index] !== refs[index]) return false;
-  }
-  return true;
-}
-
-function _buildWirePayload(id, session, forceFull = false) {
-  const live = Array.isArray(session.messages) ? session.messages : [];
-  const base = forceFull ? null : _deltaBaseline.get(id);
-  const resyncDue = !base || base.deltasSinceFull >= DELTA_FULL_RESYNC_EVERY;
-  if (!resyncDue && _isPureAppend(base.refs, live)) {
-    // Header: full disk projection with an empty message list (strips
-    // transient aliases); tail: per-message projection of the appended
-    // suffix only. Both use the same idempotent per-message projection
-    // as a full send, so worker-side reconstruction is byte-identical.
-    const header = _sessionForDisk({ ...session, messages: [] });
-    const tailMessages = _messagesForDisk(live.slice(base.refs.length));
-    // The EXACT payload the worker will reconstruct and write is the sent
-    // baseline + this delta. Its evidence is fingerprint-checked against
-    // what was sent, never a fresh projection of the mutable live session
-    // (an in-place nested edit of an already-sent message is NOT part of a
-    // reference-identity delta). Only the tail is fingerprinted.
-    const prints = base.prints ? base.prints.concat(tailMessages.map(_messagePrint)) : null;
-    const refs = live.slice();
-    _deltaBaseline.set(id, { refs, deltasSinceFull: base.deltasSinceFull + 1, prints });
-    return {
-      delta: { baseCount: base.refs.length, header, tailMessages },
-      attempt: _attemptRecord(header, refs, prints),
-    };
-  }
-  const full = _sessionForDisk(session);
-  const diskMessages = Array.isArray(full.messages) ? full.messages : [];
-  // A prefix change (compaction, edit, repair) keeps the fingerprints of
-  // every unchanged message. The periodic resync, a forced full retry and a
-  // missing baseline re-fingerprint everything, so in-place nested edits of
-  // settled messages become provable evidence again at least every
-  // DELTA_FULL_RESYNC_EVERY saves.
-  const refs = live.slice();
-  const prints = _printMessages(live, diskMessages, resyncDue ? null : base);
-  _deltaBaseline.set(id, { refs, deltasSinceFull: 0, prints });
-  // (saveSessionAsync normalizes `messages` to an array before any post.)
-  return { session: full, attempt: _attemptRecord(full, refs, prints) };
-}
-
 // ── Fault-state mirroring (parent → worker) ─────────────────────────────────
 // The worker thread is long-lived and owns its own module instance of
 // save-fault.mjs, which setSessionSaveFault() never reaches, so the parent
@@ -491,7 +364,7 @@ function _releaseIdleWorker(worker) {
   _saveWorker = null;
   _faultSyncedKey = null;
   // Its delta bases go with it: the parent baselines would only miss.
-  _deltaBaseline.clear();
+  _clearDeltaBaselines();
   // Adopts the worker's last commit stamps, then closes the channel.
   connectOwnCommitPeer(null);
   worker.terminate().catch(() => {});
@@ -558,7 +431,7 @@ function _onWorkerReply(worker, reply) {
 function _retireWorkerBookkeeping(err) {
   _saveWorker = null;
   _faultSyncedKey = null;
-  _deltaBaseline.clear();
+  _clearDeltaBaselines();
   for (const [, p] of _saveWorkerPending) {
     _failWorkerWrite(p.id, p.summaryVersion, p.waiters, err, p.epoch, p.incarnation, _attemptEvidence(p.attempt));
     _releaseSessionIncarnation(p.incarnation);
@@ -884,7 +757,7 @@ export function _resetSaveWorkerBookkeeping() {
   _saveAsyncQueued.clear();
   _saveAsyncInflight.clear();
   _saveWorkerRefCount = 0;
-  _deltaBaseline.clear();
+  _clearDeltaBaselines();
 }
 
 const _noopSettle = () => {};

package/src/runtime/agent/orchestrator/session/store/summary-cache.mjs

@@ -155,9 +155,9 @@ export function _queueSummaryIndexPrune(ids) {
 }
 
 // ── Incremental storage scan ────────────────────────────────────────────────
-// refreshFromStorage used to re-parse EVERY session JSON (full transcripts,
-// multi-MB files) on each desktop sidebar refresh. A summary only changes when
-// its file changes, so key a per-file row cache on (mtimeMs, size): unchanged
+// A refreshFromStorage that re-parsed EVERY session JSON (full transcripts,
+// multi-MB files) on each desktop sidebar refresh would be far too costly. A
+// summary only changes when its file changes, so key a per-file row cache on (mtimeMs, size): unchanged
 // files reuse the cached row, changed/new files re-parse, vanished files drop
 // out. Storage stays the truth source — the sidecar index is never trusted.
 const _summaryScanCache = new Map(); // filename → { mtimeMs, size, row|null }

package/src/runtime/agent/orchestrator/session/store/sweep/stale-sweep.mjs

@@ -20,8 +20,10 @@ function* sweepStaleSessionSteps(ttlMs, options = {}) {
   const dir = getStoreDir();
   // An unreadable store dir is not an empty one: sweeping (deleting,
   // closing, pruning) on a probe we could not make is never allowed.
-  if (probePath(dir).state !== PROBE_PRESENT)
-    return { cleaned: 0, remaining: 0, details: [], tombstonesCleaned: 0, tombstoneDetails: [], tombstoneErrors: [] };
+  if (probePath(dir).state !== PROBE_PRESENT) {
+    const { openCandidates: _candidates, ...empty } = createSweepTally();
+    return empty;
+  }
   const rows = collectSweepRows(dir);
   pruneSweepRecordCache(new Set(rows.map((row) => row?.id).filter(Boolean)));
   const ctx = { plan, dir, now: Date.now(), tally: createSweepTally() };

package/src/runtime/agent/orchestrator/session/store/sweep/sweep-finish.mjs

@@ -5,7 +5,7 @@ import { readdirSync, unlinkSync } from 'node:fs';
 import { join } from 'node:path';
 import { probePath, PROBE_PRESENT, PROBE_ABSENT } from '../fs-probe.mjs';
 import { _queueSummaryIndexPrune } from '../summary-cache.mjs';
-import { deleteSession } from '../../store.mjs';
+import { deleteSession } from '../session-delete.mjs';
 
 /** Retention cap: prune resumable open (non-tombstone) sessions newest-first
  *  — keep the most recent openMaxCount, prune anything older than openMaxAgeMs

package/src/runtime/agent/orchestrator/session/store/sweep/sweep-row.mjs

@@ -8,11 +8,12 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { isAgentOwner } from '../../../agent-owner.mjs';
 import { readTopLevelLifecycleRecord, isLifecycleUnreadable } from '../../lifecycle-scan.mjs';
-import { resolveAgentTerminalReapMs } from '../../../../../../session-runtime/config-helpers.mjs';
+import { resolveAgentTerminalReapMs } from '../../../runtime-core/config-helpers.mjs';
 import { sessionPath } from '../paths-heartbeat.mjs';
 import { probePath, PROBE_PRESENT, PROBE_ABSENT } from '../fs-probe.mjs';
 import { _queueSessionSummaryUpsert, _queueSessionSummaryRemoval } from '../summary-cache.mjs';
-import { deleteSession, markSessionClosed } from '../../store.mjs';
+import { deleteSession } from '../session-delete.mjs';
+import { markSessionClosed } from '../lifecycle-barriers.mjs';
 import {
   AGENT_TERMINAL_STATUSES,
   BLANK_SCRATCH_MAX_AGE_MS,

package/src/runtime/agent/orchestrator/session/store/write-admission.mjs

@@ -12,6 +12,8 @@ import {
   statSessionStamp as _statSessionStamp,
   sameSessionStamp as _sameSessionStamp,
 } from './canonical-reader.mjs';
+import { isCancelledWrite as _isCancelledWrite } from './write-guards.mjs';
+import { _setSessionWriteAuthorityCheck } from './save-worker.mjs';
 
 const _observeStamp = (target) => {
   try {
@@ -48,8 +50,6 @@ function _writeAuthorityRecord(target, attempt) {
   }
   return record;
 }
-import { isCancelledWrite as _isCancelledWrite } from './write-guards.mjs';
-import { _setSessionWriteAuthorityCheck } from './save-worker.mjs';
 
 /**
  * Write admission for ONE save attempt. Consulted upfront, after the scratch
@@ -66,11 +66,9 @@ import { _setSessionWriteAuthorityCheck } from './save-worker.mjs';
  *                                   record just because it carries no
  *                                   expectedGeneration;
  *   ours                          → apply the generation rules below.
- * NOTHING is exempt. The old `allowClosed` opt-out is gone: it existed for a
- * tombstone plant that has not gone through this path in a long time (the
- * barriers write the canonical file themselves), and any surviving caller of
- * it would have been able to skip the absent-vs-owned-vs-ambiguous check
- * entirely — the exact hole this guard exists to close.
+ * NOTHING is exempt: there is no opt-out that skips the absent-vs-owned-vs-
+ * ambiguous check (the lifecycle barriers write the canonical file themselves,
+ * under their own authority read).
  */
 export function _shouldDrop(id, opts, attempt = null) {
   if (_isCancelledWrite(opts)) return true;
@@ -113,22 +111,11 @@ export function _shouldDrop(id, opts, attempt = null) {
   return generation > expected;
 }
 
-// ── Lifecycle read for the ownership guard ───────────────────────────────────
-// _shouldDrop consults this up to three times per save (upfront, post-temp
-// write, in-commit). mtimeMs + size alone would NOT move for a same-size
-// rewrite inside one clock tick — a generation bump such as 1 → 2 — so no
-// memo keys on them. The only reuse is this realm's OWN last rename, stamped
-// { dev, ino, size, mtimeNs, ctimeNs } right after the commit and verified to
-// be our inode: every writer replaces the file by rename (new inode, new
-// ctime), so any foreign replacement misses the stamp and is re-read and
-// strictly parsed exactly as before.
-//
-// Three distinct outcomes, never collapsed: `null` = no file (write freely),
-// LIFECYCLE_AMBIGUOUS = a file exists but its bytes cannot be trusted (refuse
-// the write), otherwise the strict record itself ({ doc, id, closed,
+// Three distinct read outcomes, never collapsed: `null` = no file (write
+// freely), LIFECYCLE_AMBIGUOUS = a file exists but its bytes cannot be trusted
+// (refuse the write), otherwise the strict record itself ({ doc, id, closed,
 // generation }) — the single disk authority shared by the save guard and the
-// lifecycle barriers.
-// Full lifecycle barriers still parse a private document.
+// lifecycle barriers. Stamp-keyed reuse lives in canonical-reader.mjs.
 
 // Pre-admission authority for the async/worker path (registered here because
 // save-worker.mjs cannot import this module back). A refusal keeps the caller

package/src/runtime/agent/orchestrator/session/store-agent-worker-rows.mjs

@@ -12,6 +12,7 @@
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { probePath, PROBE_PRESENT } from './store/fs-probe.mjs';
+import { readJsonProjection } from '../../../shared/pending-json-projection.mjs';
 import { listStoredAgentWorkers as assembleStoredAgentWorkers } from './store-agent-worker-pool.mjs';
 import {
   TAG_TOMBSTONE_TTL_MS,
@@ -162,8 +163,12 @@ function preferUnconfirmedCancel(a, b) {
 }
 
 function storedAgentWorkerIndex() {
+  const path = storedAgentWorkerIndexPath();
+  // This process's own queued (not yet persisted) writes win over the file.
+  const projected = readJsonProjection(path);
+  if (projected) return projected;
   try {
-    return JSON.parse(readFileSync(storedAgentWorkerIndexPath(), 'utf8'));
+    return JSON.parse(readFileSync(path, 'utf8'));
   } catch {
     return null;
   }
@@ -405,11 +410,14 @@ function promoteHeartbeatSidecar(bySessionId, sessionId, heartbeatAt) {
 }
 
 function storedLeadWorkerRows() {
-  let parsed = null;
-  try {
-    parsed = JSON.parse(readFileSync(storedLeadWorkerIndexPath(), 'utf8'));
-  } catch {
-    /* no resident Lead pool */
+  const path = storedLeadWorkerIndexPath();
+  let parsed = readJsonProjection(path);
+  if (!parsed) {
+    try {
+      parsed = JSON.parse(readFileSync(path, 'utf8'));
+    } catch {
+      /* no resident Lead pool */
+    }
   }
   return workerRows(parsed);
 }