mixdog 0.9.3 → 0.9.4

package/src/runtime/agent/orchestrator/session/manager.mjs

@@ -1,28 +1,20 @@
 import { createRequire } from 'module';
 import { fileURLToPath } from 'url';
 import { randomBytes, createHash } from 'crypto';
-import { getProvider, providerInputExcludesCache } from '../providers/registry.mjs';
-import { fetchOAuthUsageSnapshot } from '../providers/oauth-usage.mjs';
+import { getProvider } from '../providers/registry.mjs';
 // Image content is kept in-memory and in the model-visible history so multi-turn
 // recognition works reliably (live transcript always retains images). The
 // stored-history placeholder swap now happens only at disk-serialization time
 // inside the session store, so it is no longer imported here.
 import {
-    recallFastTrackCompactMessages,
-    semanticCompactMessages,
-    pruneToolOutputsUnanchored,
-    effectiveBudget as compactEffectiveBudget,
-    compactTypeIsRecallFastTrack,
-    compactTypeIsSemantic,
     normalizeCompactType,
     DEFAULT_COMPACT_TYPE,
     SUMMARY_PREFIX,
-    drainSessionCycle1,
 } from './compact.mjs';
-import { estimateMessagesTokens, estimateRequestReserveTokens, estimateTranscriptContextUsage } from './context-utils.mjs';
+import { estimateMessagesTokens, estimateTranscriptContextUsage } from './context-utils.mjs';
 import { executeInternalTool } from '../internal-tools.mjs';
 import { collectSkillsCached, buildSkillManifest, composeSystemPrompt } from '../context/collect.mjs';
-import { saveSession, saveSessionAsync, loadSession, listStoredSessionSummaries, sweepStaleSessions, markSessionClosed, publishHeartbeat, deleteHeartbeat, setLiveSession } from './store.mjs';
+import { saveSession, saveSessionAsync, loadSession, listStoredSessionSummaries, sweepStaleSessions, markSessionClosed, bumpSessionGeneration, setLiveSession } from './store.mjs';
 import { clearReadDedupSession, tryPrefetchCached, setPrefetchCached } from './read-dedup.mjs';
 import { clearOffloadSession } from './tool-result-offload.mjs';
 import { classifyResultKind } from './result-classification.mjs';
@@ -31,12 +23,16 @@ import { logLlmCall } from '../../../shared/llm/usage-log.mjs';
 import { appendAgentTrace } from '../agent-trace.mjs';
 import { isAgentOwner } from '../agent-owner.mjs';
 import { getHiddenAgent } from '../internal-agents.mjs';
-import { DEFAULT_ACTIVITY_HEARTBEAT_MS } from '../stall-policy.mjs';
+import { loadConfig } from '../config.mjs';
+import { buildProviderCacheOpts, cacheCapabilityForProvider } from '../agent-runtime/cache-strategy.mjs';
+import { normalizeAutoClearConfig, resolveAutoClearIdleMs } from '../../../../session-runtime/config-helpers.mjs';
 import {
-    buildGatewayLimits,
-    recordGatewayUsageEvent,
-    summarizeGatewayUsage,
-} from '../providers/statusline-route-meta.mjs';
+    recordStandaloneStatusTelemetry,
+} from './manager/status-telemetry.mjs';
+import {
+    normalizeStaleCompactingStage,
+    runSessionCompaction,
+} from './manager/compaction-runner.mjs';
 // Split modules — see manager/ directory. manager.mjs is now a thin facade that
 // orchestrates these cohesive units while keeping the exact public surface.
 import {
@@ -59,9 +55,6 @@ import {
     preserveBufferConfigFields,
     resolveSessionContextMeta,
     compactTriggerForSession,
-    compactTargetBudget,
-    semanticCompactionEnabledForSession,
-    compactTypeForSession,
 } from './manager/context-meta.mjs';
 import {
     promptContentText,
@@ -80,11 +73,89 @@ import {
     drainPendingMessages,
     _dropPendingMessageState,
 } from './manager/pending-messages.mjs';
+import {
+    bumpUsageMetricsTurnId,
+    resolveUsageMetricsTurnId,
+    bumpUsageMetricsEpoch,
+    resolveUsageMetricsEpoch,
+    usageMetricsSourceKey,
+    usageMetricsIdempotencyKey,
+    uncachedInputTokensForProvider,
+    applyAskTerminalUsageTotals,
+    persistIterationMetrics,
+} from './manager/usage-metrics.mjs';
+// Runtime-liveness map + accessors — extracted (pass-3) to
+// manager/runtime-liveness.mjs. State is a module-level singleton there,
+// preserving the baseline single-process shape. manager.mjs keeps askSession's
+// controller/generation lifecycle and calls these via imports. The two
+// _get/_entries accessors expose the private Map for in-place mutation from
+// closeSession / idle-sweep / askSession.
+import {
+    configureRuntimeLiveness,
+    updateSessionStage,
+    markSessionAskStart,
+    markSessionStreamDelta,
+    markSessionToolCall,
+    markSessionDone,
+    markSessionEmptyFinal,
+    markSessionError,
+    markSessionCancelled,
+    getSessionRuntime,
+    isSessionCompactionBlocked,
+    getSessionProgressSnapshot,
+    forEachSessionRuntime,
+    hideSessionFromList,
+    getSessionAbortSignal,
+    getSessionLastProgressAt,
+    linkParentSignalToSession,
+    _touchRuntime,
+    _stopToolActivityHeartbeat,
+    _unlinkParentAbortListener,
+    _clearSessionRuntime,
+    _getRuntimeEntry,
+    _runtimeEntries,
+} from './manager/runtime-liveness.mjs';
+// Facade re-exports — external importers (loop.mjs, loop/tool-exec.mjs,
+// agent-dispatch.mjs, abort-lookup.mjs, statusline-agents.mjs) resolve these
+// through manager.mjs unchanged.
+export {
+    updateSessionStage,
+    markSessionAskStart,
+    markSessionStreamDelta,
+    markSessionToolCall,
+    markSessionDone,
+    markSessionEmptyFinal,
+    markSessionError,
+    markSessionCancelled,
+    getSessionRuntime,
+    isSessionCompactionBlocked,
+    getSessionProgressSnapshot,
+    forEachSessionRuntime,
+    hideSessionFromList,
+    getSessionAbortSignal,
+    getSessionLastProgressAt,
+    linkParentSignalToSession,
+};
+// Wire the store deps the liveness module needs without importing store.mjs
+// back into it via manager.mjs (avoids re-entry / keeps one store contract).
+configureRuntimeLiveness({ loadSession, saveSessionAsync });
 // Re-export split-module public/test surface unchanged so every importer of the
 // old symbol names keeps resolving through the facade.
 export { previewSessionTools };
 export { _mergePendingMessageEntries, enqueuePendingMessage, drainPendingMessages };
 export { isInternalRuntimeNotificationText as _isInternalRuntimeNotificationText };
+// Usage-metrics surface — re-exported unchanged so loop.mjs / smoke scripts keep
+// resolving these through the facade.
+export {
+    bumpUsageMetricsTurnId,
+    resolveUsageMetricsTurnId,
+    bumpUsageMetricsEpoch,
+    resolveUsageMetricsEpoch,
+    usageMetricsSourceKey,
+    usageMetricsIdempotencyKey,
+    applyAskTerminalUsageTotals,
+    persistIterationMetrics,
+};
 let _codeGraphRuntimePromise = null;
 let _agentLoopPromise = null;
 let _bashSessionRuntimePromise = null;
@@ -146,7 +217,6 @@ export class SessionClosedError extends Error {
         this.reason = closeReason || null;
     }
 }
-const HEARTBEAT_THROTTLE_MS = 60_000; // 60s
 // Cap how long the terminal unwind blocks on the post-result session save.
 // The result is already produced (and relayed for agent surfaces) before this
 // save, so a stalled disk write must not hold askSession() open — otherwise the
@@ -186,442 +256,6 @@ let nextId = Date.now();
 export const _resolveSessionContextMeta = resolveSessionContextMeta;
 export const _compactTriggerForSession = compactTriggerForSession;
 export const _preserveBufferConfigFields = preserveBufferConfigFields;
-// 'compacting' is a transient in-flight stage written just before semantic /
-// recall-fasttrack compaction runs. If the process crashes or only partially
-// saves while it is set, a later load/resume reads a session that is NOT
-// actually compacting but whose UI marker (App.jsx / ContextPanel) shows
-// "Compacting conversation" permanently. Normalize that stale transient stage
-// to 'interrupted' so the surface recovers. Terminal stages (post_turn /
-// manual / auto_clear / *_failed / overflow_failed) are intentionally left as
-// the durable record of the last real outcome.
-function normalizeStaleCompactingStage(session) {
-    const c = session?.compaction;
-    if (!c || typeof c !== 'object') return false;
-    if (c.lastStage !== 'compacting' && c.inProgress !== true) return false;
-    c.lastStage = 'interrupted';
-    c.inProgress = false;
-    c.lastCheckedAt = Date.now();
-    return true;
-}
-function addCompactUsageToSession(session, usage) {
-    if (!session || !usage) return;
-    const inputTokens = usage.inputTokens || 0;
-    const outputTokens = usage.outputTokens || 0;
-    const cachedTokens = usage.cachedTokens || 0;
-    const cacheWriteTokens = usage.cacheWriteTokens || 0;
-    const uncachedInputTokens = uncachedInputTokensForProvider(session.provider, inputTokens, cachedTokens, cacheWriteTokens);
-    session.totalInputTokens = (session.totalInputTokens || 0) + inputTokens;
-    session.totalOutputTokens = (session.totalOutputTokens || 0) + outputTokens;
-    session.totalCachedReadTokens = (session.totalCachedReadTokens || 0) + cachedTokens;
-    session.totalCacheWriteTokens = (session.totalCacheWriteTokens || 0) + cacheWriteTokens;
-    session.totalUncachedInputTokens = (session.totalUncachedInputTokens || 0) + uncachedInputTokens;
-    session.tokensCumulative = (session.tokensCumulative || 0) + inputTokens + outputTokens;
-}
-async function runRecallFastTrackForSession(session, messages, opts = {}) {
-    const sessionId = opts.sessionId || session?.id || null;
-    if (!sessionId) throw new Error('recall-fasttrack requires a session id');
-    const query = `session:${sessionId}:all-chunks`;
-    const querySha = createHash('sha256').update(query).digest('hex').slice(0, 16);
-    const callerCtx = {
-        callerSessionId: sessionId,
-        callerCwd: session?.cwd || undefined,
-        routingSessionId: sessionId,
-        clientHostPid: session?.clientHostPid,
-        signal: opts.signal || null,
-    };
-    const hydrateLimit = positiveContextWindow(session?.compaction?.recallIngestLimit)
-        || Math.max(500, Math.min(5000, messages.length || 0));
-    try {
-        await executeInternalTool('memory', {
-            action: 'ingest_session',
-            sessionId,
-            messages,
-            cwd: session?.cwd,
-            limit: hydrateLimit,
-        }, callerCtx);
-    } catch (err) {
-        try { process.stderr.write(`[session] recall-fasttrack ingest skipped (sess=${sessionId}): ${err?.message || err}\n`); } catch {}
-    }
-    const dumpArgs = {
-        action: 'dump_session_roots',
-        sessionId,
-        includeRaw: true,
-        limit: positiveContextWindow(session?.compaction?.recallChunkLimit ?? session?.compaction?.recallLimit) || hydrateLimit,
-    };
-    const runTool = (name, args) => executeInternalTool(name, args, callerCtx);
-    let recallText = await executeInternalTool('memory', dumpArgs, callerCtx);
-    let cycle1Text = '';
-    const hasRawRows = /(?:^|\n)# raw_pending\s+\d+\s+id=/i.test(String(recallText || ''));
-    if (hasRawRows) {
-        try {
-            // Drain this session's cycle1 in window×concurrency units until no
-            // raw rows remain, so the injected root is fully chunked rather than
-            // carrying the unprocessed transcript tail (single-pass left raw in).
-            const drained = await drainSessionCycle1(runTool, {
-                sessionId,
-                dumpArgs,
-                deadlineMs: positiveContextWindow(session?.compaction?.recallCycle1DeadlineMs) || 120_000,
-                maxPasses: positiveContextWindow(session?.compaction?.recallCycle1MaxPasses) || 0,
-                cycleArgs: {
-                    min_batch: 1,
-                    session_cap: 1,
-                    batch_size: positiveContextWindow(session?.compaction?.recallCycle1BatchSize) || 100,
-                    rows_per_session: positiveContextWindow(session?.compaction?.recallRowsPerSession) || 100,
-                    window_size: positiveContextWindow(session?.compaction?.recallWindowSize) || 20,
-                    concurrency: positiveContextWindow(session?.compaction?.recallConcurrency) || 5,
-                },
-            });
-            recallText = drained.recallText;
-            cycle1Text = drained.cycle1Text;
-            if (drained.rawRemaining > 0) {
-                try { process.stderr.write(`[session] recall-fasttrack drained passes=${drained.passes} rawRemaining=${drained.rawRemaining} (sess=${sessionId})\n`); } catch {}
-            }
-        } catch (err) {
-            try { process.stderr.write(`[session] recall-fasttrack cycle1 skipped (sess=${sessionId}): ${err?.message || err}\n`); } catch {}
-        }
-    } else {
-        cycle1Text = 'cycle1: skipped (session chunks already hydrated)';
-    }
-    return { query, querySha, recallText: [`session_id=${sessionId}`, cycle1Text, recallText].map(v => String(v || '').trim()).filter(Boolean).join('\n\n') };
-}
-// Element-identity change detection (same approach as loop.mjs messagesArrayChanged): two
-// arrays are "unchanged" only when same length AND every slot is the same object
-// reference. Used to reject a no-op prune (which returns a fresh array whose
-// elements are the untouched originals) from being accepted as a recovery.
-function messagesChanged(before, after) {
-    if (!Array.isArray(before) || !Array.isArray(after)) return before !== after;
-    if (before.length !== after.length) return true;
-    for (let i = 0; i < before.length; i += 1) {
-        if (before[i] !== after[i]) return true;
-    }
-    return false;
-}
-async function runSessionCompaction(session, opts = {}) {
-    if (!session || session.closed === true) return null;
-    const mode = opts.mode === 'auto' ? 'auto' : 'manual';
-    const force = opts.force === true || mode === 'manual';
-    if (mode === 'auto' && session.compaction?.auto === false) return null;
-    const messages = Array.isArray(session.messages) ? session.messages : [];
-    if (messages.length < 3 && !force) return null;
-    const boundary = positiveContextWindow(session.compactBoundaryTokens)
-        || positiveContextWindow(session.autoCompactTokenLimit)
-        || positiveContextWindow(session.contextWindow);
-    if (!boundary) {
-        if (force) throw new Error('compact: no context window is available for this session');
-        return null;
-    }
-    // Reserve must mirror loop.mjs (buildCompactPolicy): request reserve (tool
-    // schema) PLUS the configured reserve (session.compaction.reservedTokens or
-    // MIXDOG_AGENT_COMPACT_RESERVED_TOKENS env). The old request-only value left
-    // the manual / auto-clear compact budget without the configured headroom the
-    // loop path reserves, so a compacted transcript could overflow on next send.
-    const requestReserveTokens = estimateRequestReserveTokens(session.tools || []);
-    const configuredReserveTokens = positiveContextWindow(session.compaction?.reservedTokens)
-        || positiveContextWindow(process.env.MIXDOG_AGENT_COMPACT_RESERVED_TOKENS)
-        || 0;
-    const reserveTokens = requestReserveTokens + configuredReserveTokens;
-    const beforeMessageTokens = estimateMessagesTokens(messages);
-    const triggerTokens = compactTriggerForSession(session, boundary)
-        || positiveContextWindow(session.compaction?.triggerTokens)
-        || boundary;
-    const bufferTokens = Math.max(0, boundary - triggerTokens);
-    const bufferRatio = boundary ? (bufferTokens / boundary) : compactBufferRatioForSession(session);
-    const pressureTokens = estimateTranscriptContextUsage(messages, session.tools || []);
-    const beforeTokens = pressureTokens;
-    const compactType = compactTypeForSession(session);
-    if (!force && pressureTokens < triggerTokens) return {
-        changed: false,
-        reason: 'below threshold',
-        compactType,
-        beforeMessages: messages.length,
-        afterMessages: messages.length,
-        beforeTokens,
-        afterTokens: beforeTokens,
-        beforeMessageTokens,
-        afterMessageTokens: beforeMessageTokens,
-        pressureTokens,
-        triggerTokens,
-        bufferTokens,
-        bufferRatio,
-        boundaryTokens: boundary,
-        budgetTokens: boundary,
-        targetBudgetTokens: boundary,
-        reserveTokens,
-        semanticCompact: false,
-    };
-    const budgetSourceTokens = force ? Math.max(pressureTokens, triggerTokens) : pressureTokens;
-    const compactBudget = compactTargetBudget(boundary, reserveTokens, budgetSourceTokens);
-    const budget = compactBudget || boundary;
-    try { opts.onStageChange?.('compacting'); } catch { /* best-effort */ }
-    const provider = opts.provider || getProvider(session.provider) || null;
-    let compacted;
-    let compactError = null;
-    let semanticCompactResult = null;
-    let semanticCompactError = null;
-    let recallFastTrackResult = null;
-    let recallFastTrackError = null;
-    if (compactTypeIsRecallFastTrack(compactType)) {
-        try {
-            const recallPayload = await runRecallFastTrackForSession(session, messages, opts);
-            recallFastTrackResult = recallFastTrackCompactMessages(messages, budget, {
-                reserveTokens,
-                force: true,
-                recallText: recallPayload.recallText,
-                query: recallPayload.query,
-                querySha: recallPayload.querySha,
-                // Ingest just ran on the live transcript, so an empty recall dump
-                // means the memory pipeline is broken — do NOT erase history
-                // behind an empty summary shell. Empty recall now throws and is
-                // handled by the semantic fallback below (or recorded failure).
-                allowEmptyRecall: false,
-                tailTurns: positiveContextWindow(session.compaction?.tailTurns) || 2,
-                keepTokens: positiveContextWindow(session.compaction?.keepTokens ?? session.compaction?.keep?.tokens),
-                preserveRecentTokens: positiveContextWindow(session.compaction?.preserveRecentTokens),
-            });
-            if (Array.isArray(recallFastTrackResult?.messages)) {
-                compacted = recallFastTrackResult.messages;
-            }
-        } catch (err) {
-            recallFastTrackError = err;
-            compactError = err;
-            try {
-                process.stderr.write(`[session] recall-fasttrack ${mode} compact failed (sess=${session.id || 'unknown'}): ${err?.message || err}\n`);
-            } catch { /* best-effort */ }
-            // Degraded-compact fallback: recall-fasttrack failed (empty recall,
-            // ingest error, fit failure). Before recording a hard failure, try
-            // the semantic path once so auto-clear/manual compaction still makes
-            // progress WITHOUT shipping an empty-recall summary. History is only
-            // replaced when the semantic summary actually succeeds.
-            if (semanticCompactionEnabledForSession(session)
-                && provider && typeof provider.send === 'function') {
-                try {
-                    semanticCompactResult = await semanticCompactMessages(
-                        provider,
-                        messages,
-                        opts.model || session.model,
-                        budget,
-                        {
-                            reserveTokens,
-                            providerName: session.provider || provider?.name || null,
-                            sessionId: opts.sessionId || session.id || null,
-                            signal: opts.signal || null,
-                            promptCacheKey: session.promptCacheKey || null,
-                            providerCacheKey: session.promptCacheKey || null,
-                            timeoutMs: positiveContextWindow(session.compaction?.timeoutMs) || 30_000,
-                            tailTurns: positiveContextWindow(session.compaction?.tailTurns) || 2,
-                            keepTokens: positiveContextWindow(session.compaction?.keepTokens ?? session.compaction?.keep?.tokens),
-                            preserveRecentTokens: positiveContextWindow(session.compaction?.preserveRecentTokens),
-                            force: true,
-                        },
-                    );
-                    if (Array.isArray(semanticCompactResult?.messages)) {
-                        compacted = semanticCompactResult.messages;
-                        compactError = null;
-                        addCompactUsageToSession(session, semanticCompactResult.usage);
-                        try {
-                            process.stderr.write(`[session] degraded compact: recall-fasttrack failed, semantic fallback succeeded (sess=${session.id || 'unknown'}, mode=${mode})\n`);
-                        } catch { /* best-effort */ }
-                    }
-                } catch (fallbackErr) {
-                    semanticCompactError = fallbackErr;
-                    try {
-                        process.stderr.write(`[session] degraded compact: semantic fallback also failed (sess=${session.id || 'unknown'}): ${fallbackErr?.message || fallbackErr}\n`);
-                    } catch { /* best-effort */ }
-                }
-            }
-        }
-    } else if (compactTypeIsSemantic(compactType)) {
-        try {
-            if (!semanticCompactionEnabledForSession(session)) {
-                throw new Error('semantic compact is disabled for this session');
-            }
-            if (!provider || typeof provider.send !== 'function') {
-                throw new Error(`semantic compact provider unavailable: ${session.provider || 'unknown'}`);
-            }
-            semanticCompactResult = await semanticCompactMessages(
-                provider,
-                messages,
-                opts.model || session.model,
-                budget,
-                {
-                    reserveTokens,
-                    providerName: session.provider || provider?.name || null,
-                    sessionId: opts.sessionId || session.id || null,
-                    signal: opts.signal || null,
-                    promptCacheKey: session.promptCacheKey || null,
-                    providerCacheKey: session.promptCacheKey || null,
-                    timeoutMs: positiveContextWindow(session.compaction?.timeoutMs) || 30_000,
-                    tailTurns: positiveContextWindow(session.compaction?.tailTurns) || 2,
-                    keepTokens: positiveContextWindow(session.compaction?.keepTokens ?? session.compaction?.keep?.tokens),
-                    preserveRecentTokens: positiveContextWindow(session.compaction?.preserveRecentTokens),
-                    force: true,
-                },
-            );
-            if (Array.isArray(semanticCompactResult?.messages)) {
-                compacted = semanticCompactResult.messages;
-                addCompactUsageToSession(session, semanticCompactResult.usage);
-            }
-        } catch (err) {
-            semanticCompactError = err;
-            compactError = err;
-            try {
-                process.stderr.write(`[session] semantic ${mode} compact failed (sess=${session.id || 'unknown'}): ${err?.message || err}\n`);
-            } catch { /* best-effort */ }
-        }
-    }
-    if (!compacted && !compactError) {
-        compactError = new Error(`${compactType} compact produced no messages`);
-    }
-    // Anchor-independent prune safety net (mirror loop.mjs compact catch): when a
-    // non-recall (semantic) compact failed, try one non-LLM prune that needs no
-    // user anchor before recording failure, so Lead manual / auto-clear paths
-    // recover the same transcripts the loop path does. Gated off the recall
-    // path — a recall failure keeps its original contract (no silent prune).
-    if (!compacted && !recallFastTrackError) {
-        try {
-            const acceptThreshold = compactEffectiveBudget(budget, { reserveTokens });
-            const salvaged = pruneToolOutputsUnanchored(messages, budget, { reserveTokens });
-            // pruneToolOutputsUnanchored ALWAYS returns a fresh reconciled array
-            // (never the input identity), so `salvaged !== messages` is always
-            // true and cannot detect a no-op. Compare by element identity so a
-            // transcript that already fit (nothing pruned) is NOT falsely accepted
-            // as a recovery — that would clear compactError and unconditionally
-            // invalidate providerState for an unchanged transcript.
-            if (Array.isArray(salvaged)
-                && messagesChanged(messages, salvaged)
-                && estimateMessagesTokens(salvaged) <= acceptThreshold) {
-                compacted = salvaged;
-                compactError = null;
-                try {
-                    process.stderr.write(`[session] compact fallback prune recovered (sess=${session.id || 'unknown'}, mode=${mode})\n`);
-                } catch { /* best-effort */ }
-            }
-        } catch { /* fall through to failure record */ }
-    }
-    if (!compacted) {
-        const now = Date.now();
-        session.compaction = {
-            ...(session.compaction || {}),
-            auto: mode === 'auto' ? true : session.compaction?.auto !== false,
-            boundaryTokens: boundary,
-            triggerTokens,
-            bufferTokens,
-            bufferRatio,
-            reserveTokens,
-            lastStage: mode === 'auto' ? 'post_turn_failed' : 'manual_failed',
-            lastBeforeTokens: beforeTokens,
-            lastAfterTokens: beforeTokens,
-            lastBeforeMessageTokens: beforeMessageTokens,
-            lastAfterMessageTokens: beforeMessageTokens,
-            lastPressureTokens: pressureTokens,
-            lastCheckedAt: now,
-            lastChanged: false,
-            type: compactType,
-            compactType,
-            lastCompactType: compactType,
-            lastSemantic: false,
-            lastSemanticError: semanticCompactError?.message || null,
-            lastRecallFastTrack: false,
-            lastRecallFastTrackError: recallFastTrackError?.message || null,
-            lastError: compactError?.message || semanticCompactError?.message || recallFastTrackError?.message || String(compactError || semanticCompactError || recallFastTrackError || 'compact failed'),
-        };
-        return {
-            changed: false,
-            error: session.compaction.lastError,
-            compactType,
-            beforeMessages: messages.length,
-            afterMessages: messages.length,
-            beforeTokens,
-            afterTokens: beforeTokens,
-            beforeMessageTokens,
-            afterMessageTokens: beforeMessageTokens,
-            pressureTokens,
-            triggerTokens,
-            bufferTokens,
-            bufferRatio,
-            boundaryTokens: boundary,
-            budgetTokens: boundary,
-            targetBudgetTokens: budget,
-            reserveTokens,
-            semanticCompact: false,
-            semanticError: semanticCompactError?.message || null,
-            recallFastTrack: false,
-            recallFastTrackError: recallFastTrackError?.message || null,
-        };
-    }
-    let beforeEncoded = '';
-    let afterEncoded = '';
-    try { beforeEncoded = JSON.stringify(messages); } catch { beforeEncoded = ''; }
-    try { afterEncoded = JSON.stringify(compacted); } catch { afterEncoded = ''; }
-    const afterMessageTokens = estimateMessagesTokens(compacted);
-    const afterTokens = afterMessageTokens + reserveTokens;
-    const changed = beforeEncoded && afterEncoded
-        ? beforeEncoded !== afterEncoded
-        : (compacted.length !== messages.length || afterMessageTokens !== beforeMessageTokens);
-    const unchangedReason = changed ? null : (force ? 'nothing to compact' : 'below threshold');
-    const now = Date.now();
-    session.messages = compacted;
-    session.providerState = undefined;
-    session.compaction = {
-        ...(session.compaction || {}),
-        auto: mode === 'auto' ? true : session.compaction?.auto !== false,
-        boundaryTokens: boundary,
-        triggerTokens,
-        bufferTokens,
-        bufferRatio,
-        reserveTokens,
-        type: compactType,
-        compactType,
-        lastCompactType: compactType,
-        lastStage: mode === 'auto' ? 'post_turn' : 'manual',
-        lastBeforeTokens: beforeTokens,
-        lastAfterTokens: afterTokens,
-        lastBeforeMessageTokens: beforeMessageTokens,
-        lastAfterMessageTokens: afterMessageTokens,
-        lastPressureTokens: pressureTokens,
-        lastCheckedAt: now,
-        lastChanged: changed,
-        lastChangedAt: changed ? now : session.compaction?.lastChangedAt || null,
-        lastCompactAt: changed ? now : session.compaction?.lastCompactAt || null,
-        lastSemantic: semanticCompactResult?.semantic === true,
-        lastSemanticError: semanticCompactError?.message || null,
-        lastRecallFastTrack: recallFastTrackResult?.recallFastTrack === true,
-        lastRecallFastTrackError: recallFastTrackError?.message || null,
-        lastRecallFastTrackQuerySha: recallFastTrackResult?.query ? createHash('sha256').update(recallFastTrackResult.query).digest('hex').slice(0, 16) : null,
-        lastSemanticUsage: semanticCompactResult?.usage ? {
-            inputTokens: semanticCompactResult.usage.inputTokens || 0,
-            outputTokens: semanticCompactResult.usage.outputTokens || 0,
-            cachedTokens: semanticCompactResult.usage.cachedTokens || 0,
-            cacheWriteTokens: semanticCompactResult.usage.cacheWriteTokens || 0,
-        } : null,
-        compactCount: (session.compaction?.compactCount || 0) + (changed ? 1 : 0),
-    };
-    if (changed && mode === 'auto') session.lastContextTokensStaleAfterCompact = true;
-    return {
-        changed,
-        reason: unchangedReason,
-        compactType,
-        beforeMessages: messages.length,
-        afterMessages: compacted.length,
-        beforeTokens,
-        afterTokens,
-        beforeMessageTokens,
-        afterMessageTokens,
-        pressureTokens,
-        triggerTokens,
-        bufferTokens,
-        bufferRatio,
-        boundaryTokens: boundary,
-        budgetTokens: boundary,
-        targetBudgetTokens: budget,
-        reserveTokens,
-        semanticCompact: semanticCompactResult?.semantic === true,
-        semanticError: semanticCompactError?.message || null,
-        recallFastTrack: recallFastTrackResult?.recallFastTrack === true,
-        recallFastTrackError: recallFastTrackError?.message || null,
-        usage: semanticCompactResult?.usage || null,
-    };
-}
 // Provider-scoped unified cache key. Goal: all orchestrator-internal
 // dispatches (agent/maintenance/mcp/scheduler/webhook) targeting the
 // same provider land in a single server-side cache shard, so the
@@ -965,6 +599,34 @@ export function createSession(opts) {
     if (!provider)
         throw new Error(`Provider "${providerName}" not found or not enabled`);
     const id = `sess_${process.pid}_${nextId++}_${Date.now()}_${randomBytes(16).toString('hex')}`;
+    // Provider cache strategy — agentRuntime.resolveSync() above is a
+    // best-effort injection point (setAgentRuntime() has no live caller
+    // today, so that branch never fires); build it directly here so every
+    // session still gets a cache strategy. Lead sessions (opts.agent ===
+    // 'lead', or no agent at all — raw/CLI callers) get their BP4 message
+    // tail TTL linked to the user's autoClear idle-sweep config; hidden and
+    // public agents keep the flat 5m default (see cache-strategy.mjs docs).
+    // Scoped to explicit-breakpoint (Anthropic-family) providers only — the
+    // non-Anthropic branches of buildProviderCacheOpts (e.g. the 'openai'
+    // cacheRetention:'24h' shape) were never exercised by createSession
+    // before this change, and are left untouched to avoid altering live
+    // OpenAI/other-provider request shape as a side effect of this fix.
+    if (!providerCacheOpts && cacheCapabilityForProvider(providerName) === 'explicit-breakpoint') {
+        try {
+            let autoClear = null;
+            if (!opts.agent || opts.agent === 'lead') {
+                const loadedConfig = loadConfig({ secrets: false });
+                const normalizedAutoClear = normalizeAutoClearConfig(loadedConfig?.autoClear);
+                autoClear = {
+                    ...normalizedAutoClear,
+                    idleMs: resolveAutoClearIdleMs(loadedConfig, providerName),
+                };
+            }
+            providerCacheOpts = buildProviderCacheOpts(providerName, id, opts.agent, { autoClear });
+        } catch {
+            providerCacheOpts = null;
+        }
+    }
     const messages = [];
     const ownerIsAgent = isAgentOwner(opts.owner);
     const resolvedAgent = opts.agent || opts.role || profile?.taskType || null;
@@ -1204,69 +866,11 @@ export function createSession(opts) {
     return session;
 }
 
-// ── Runtime liveness map ──────────────────────────────────────────────
-// In-memory only. Tracks per-session stage + stream heartbeat so agent type=list
-// can surface whether a session is actually alive vs stuck. Never persisted —
-// heartbeats would otherwise churn the session JSON on every SSE delta.
-// Entry shape: {
-//   stage, lastStreamDeltaAt, lastToolCall, lastError, updatedAt,
-//   controller?: AbortController,  // set while an ask is in flight
-//   generation?: number,            // snapshot taken at ask start
-//   closed?: boolean,               // flipped by closeSession()
-// }
-const _runtimeState = new Map();
-const _toolActivityHeartbeats = new Map();
-const VALID_STAGES = new Set([
-    'connecting', 'requesting', 'streaming', 'tool_running', 'idle', 'error', 'done', 'cancelling',
-]);
-function _touchRuntime(id) {
-    let entry = _runtimeState.get(id);
-    if (!entry) {
-        entry = { stage: 'idle', lastStreamDeltaAt: null, lastToolCall: null, lastError: null, updatedAt: Date.now() };
-        _runtimeState.set(id, entry);
-    }
-    return entry;
-}
-
-function _stopToolActivityHeartbeat(id) {
-    if (!id) return;
-    const timer = _toolActivityHeartbeats.get(id);
-    if (!timer) return;
-    try { clearInterval(timer); } catch { /* ignore */ }
-    _toolActivityHeartbeats.delete(id);
-}
-
-function _touchSessionActivityProgress(id) {
-    const entry = _runtimeState.get(id);
-    if (!entry || entry.closed || entry.controller?.signal?.aborted) return;
-    if (entry.stage !== 'tool_running') return;
-    const now = Date.now();
-    entry.lastProgressAt = now;
-    entry.updatedAt = now;
-    publishHeartbeat(id, now);
-}
-
-function _startToolActivityHeartbeat(id) {
-    _stopToolActivityHeartbeat(id);
-    if (!(DEFAULT_ACTIVITY_HEARTBEAT_MS > 0)) return;
-    const timer = setInterval(() => _touchSessionActivityProgress(id), DEFAULT_ACTIVITY_HEARTBEAT_MS);
-    if (typeof timer.unref === 'function') timer.unref();
-    _toolActivityHeartbeats.set(id, timer);
-}
-
-export function updateSessionStage(id, stage) {
-    if (!id || !VALID_STAGES.has(stage)) return;
-    const entry = _touchRuntime(id);
-    const now = Date.now();
-    entry.stage = stage;
-    if (stage === 'connecting' || stage === 'requesting') {
-        entry.modelRequestStartedAt = now;
-    }
-    entry.lastProgressAt = now;
-    entry.updatedAt = now;
-    if (stage !== 'tool_running') _stopToolActivityHeartbeat(id);
-}
-
+// Runtime liveness map + its accessors moved to manager/runtime-liveness.mjs
+// (imported/re-exported above). _runtimeState is now private to that module;
+// manager.mjs internals that mutate entries in place use _getRuntimeEntry /
+// _runtimeEntries. updateSessionRoute stays here (it's a persistence helper on
+// the session store, not a liveness accessor).
 export function updateSessionRoute(id, route = {}) {
     if (!id) return null;
     const session = loadSession(id);
@@ -1322,475 +926,15 @@ export function updateSessionRoute(id, route = {}) {
     return session;
 }
 
-/**
- * Reset heartbeat-visible fields for a new ask. Preserves controller/generation/
- * closed (lifecycle) but clears the previous run's streaming state so stale
- * lastToolCall / lastStreamDeltaAt from the previous ask don't leak into the
- * new one.
- */
-export function markSessionAskStart(id) {
-    if (!id) return;
-    _stopToolActivityHeartbeat(id);
-    const entry = _touchRuntime(id);
-    entry.usageMetricsTurnIncremental = false;
-    const sessionForTurn = entry.session ?? loadSession(id);
-    if (sessionForTurn) bumpUsageMetricsTurnId(sessionForTurn);
-    entry.stage = 'connecting';
-    entry.lastStreamDeltaAt = null;
-    entry.lastToolCall = null;
-    entry.toolStartedAt = null;
-    entry.lastError = null;
-    // A new ask starts a fresh turn lifecycle — clear any stale empty-final
-    // classification from the prior turn so inspectBridgeEntry doesn't keep
-    // short-circuiting to 'empty-synthesis' (which would disable stall
-    // detection for the entire new turn).
-    entry.emptyFinal = false;
-    entry.emptyFinalAt = null;
-    // askStartedAt is the watchdog's fallback reference when a session
-    // hangs before any stream delta arrives. Without it, a provider that
-    // never returns a first token would stall forever because the watchdog
-    // keys solely on lastStreamDeltaAt.
-    const now = Date.now();
-    entry.askStartedAt = now;
-    entry.modelRequestStartedAt = now;
-    entry.lastProgressAt = now;
-    entry.updatedAt = now;
-    // Publish heartbeat immediately so the status aggregator picks the
-    // session up in the connecting / requesting window. Without this the
-    // .hb file only landed on the first stream chunk — producing a 3–10s
-    // (xhigh: 30s+) invisible gap where agent sessions ran but the CC
-    // statusline showed no maintenance/agent badge. STREAM_FRESH_MS (5 min)
-    // still drops a session whose provider truly never returns a chunk;
-    // markSessionStreamDelta keeps refreshing once chunks arrive.
-    publishHeartbeat(id, now);
-}
-export async function markSessionStreamDelta(id) {
-    if (!id) return;
-    // Non-creating lookup: a live ask ALWAYS has a runtime entry (markSessionAskStart
-    // creates it before streaming begins). _touchRuntime would instead resurrect a
-    // blank entry — and closeSession()/idle-sweep clear _runtimeState on a deferred
-    // tick while a detached provider stream may still be trickling deltas. A delta
-    // arriving after that clear must NOT re-create an entry or it would republish the
-    // .hb heartbeat that markSessionClosed deleted, orphaning a dead session's
-    // heartbeat indefinitely (the disk tombstone blocks ask resumption but not this
-    // path). Skip a missing, tombstoned, or aborted entry — never refresh liveness.
-    const entry = _runtimeState.get(id);
-    if (!entry || entry.closed || entry.controller?.signal?.aborted) return;
-    _stopToolActivityHeartbeat(id);
-    const now = Date.now();
-    entry.lastStreamDeltaAt = now;
-    entry.lastProgressAt = now;
-    // Only promote to 'streaming' if we were in a pre-stream stage; never downgrade
-    // mid-tool (tool_running has its own delta source if the tool streams back).
-    if (entry.stage === 'connecting' || entry.stage === 'requesting') {
-        entry.stage = 'streaming';
-    }
-    // Lightweight heartbeat (≤5s self-throttled) for the status aggregator.
-    // Disk-side session.lastHeartbeatAt below is the heavy 60s zombie-reaper
-    // signal; the .hb file is the fast fresh-session signal consumed by the
-    // status line.
-    publishHeartbeat(id, now);
-    const session = entry.session;
-    if (session && now - (session.lastHeartbeatAt || 0) > HEARTBEAT_THROTTLE_MS) {
-        session.lastHeartbeatAt = now;
-        await saveSessionAsync(session, { expectedGeneration: session.generation });
-    }
-    entry.updatedAt = now;
-}
-export function markSessionToolCall(id, toolName) {
-    if (!id) return;
-    const entry = _touchRuntime(id);
-    entry.stage = 'tool_running';
-    entry.lastToolCall = toolName || null;
-    entry.toolStartedAt = Date.now();
-    entry.lastProgressAt = entry.toolStartedAt;
-    entry.updatedAt = entry.toolStartedAt;
-    publishHeartbeat(id, entry.toolStartedAt);
-    _startToolActivityHeartbeat(id);
-}
-// Parent AbortSignal listeners are dropped on askSession unwind (finally /
-// terminal return) and on error/cancel/close — not in markSessionDone, which
-// also runs between queued follow-up turns within one ask.
-export function markSessionDone(id, { empty = false } = {}) {
-    if (!id) return;
-    _stopToolActivityHeartbeat(id);
-    const entry = _touchRuntime(id);
-    entry.stage = 'done';
-    entry.lastError = null;
-    entry.askStartedAt = null;
-    entry.toolStartedAt = null;
-    // Non-empty completion: drop any stale empty-final flag so a subsequent
-    // ask on the same reusable runtime entry starts clean. Empty-final
-    // completions preserve the flag (set by markSessionEmptyFinal just prior).
-    if (!empty) {
-        entry.emptyFinal = false;
-        entry.emptyFinalAt = null;
-    }
-    const doneTs = Date.now();
-    entry.doneAt = doneTs;
-    entry.lastProgressAt = doneTs;
-    entry.updatedAt = doneTs;
-    // Terminal stage — drop the heartbeat so the status badge releases
-    // immediately. A subsequent ask on the same session re-publishes via
-    // markSessionStreamDelta on the first chunk.
-    deleteHeartbeat(id);
-}
-// Tag a session as having completed with empty final synthesis (no
-// content/reasoning). Distinct from `markSessionDone`: still a success
-// (no abort), but the stall watchdog and post-mortem tools can
-// distinguish "finished empty" from "finished with content" without
-// mistaking the silence for a stall.
-export function markSessionEmptyFinal(id) {
-    if (!id) return;
-    const entry = _touchRuntime(id);
-    entry.emptyFinal = true;
-    entry.emptyFinalAt = Date.now();
-}
-export function markSessionError(id, msg) {
-    if (!id) return;
-    _stopToolActivityHeartbeat(id);
-    const entry = _touchRuntime(id);
-    entry.stage = 'error';
-    entry.lastError = msg ? String(msg).slice(0, 200) : null;
-    entry.askStartedAt = null;
-    entry.toolStartedAt = null;
-    // Error path is a non-empty completion (we have an error message, not a
-    // silent empty final). Clear the flag so the next ask starts clean.
-    entry.emptyFinal = false;
-    entry.emptyFinalAt = null;
-    const errTs = Date.now();
-    entry.doneAt = errTs;
-    entry.lastProgressAt = errTs;
-    entry.updatedAt = errTs;
-    deleteHeartbeat(id);
-    _unlinkParentAbortListener(entry);
-}
-export function markSessionCancelled(id) {
-    if (!id) return;
-    _stopToolActivityHeartbeat(id);
-    const entry = _touchRuntime(id);
-    entry.stage = 'done';
-    entry.lastError = null;
-    entry.askStartedAt = null;
-    entry.toolStartedAt = null;
-    entry.emptyFinal = false;
-    entry.emptyFinalAt = null;
-    const doneTs = Date.now();
-    entry.doneAt = doneTs;
-    entry.lastProgressAt = doneTs;
-    entry.updatedAt = doneTs;
-    deleteHeartbeat(id);
-    _unlinkParentAbortListener(entry);
-}
-export function getSessionRuntime(id) {
-    return id ? (_runtimeState.get(id) || null) : null;
-}
-
-const _COMPACTION_BLOCKED_STAGES = new Set([
-    'connecting', 'requesting', 'streaming', 'tool_running', 'cancelling',
-]);
-
-export function isSessionCompactionBlocked(sessionId) {
-    if (!sessionId) return false;
-    const entry = _runtimeState.get(sessionId);
-    if (!entry || entry.closed === true) return false;
-    if (entry.controller && !entry.controller.signal?.aborted) return true;
-    return _COMPACTION_BLOCKED_STAGES.has(entry.stage);
-}
-
-export function getSessionProgressSnapshot(sessionId) {
-    const entry = _runtimeState.get(sessionId);
-    if (!entry) return null;
-    const askStartedAt = entry.askStartedAt || 0;
-    const modelRequestStartedAt = entry.modelRequestStartedAt || askStartedAt;
-    const firstActivityAt = Math.max(
-        entry.lastStreamDeltaAt || 0,
-        entry.toolStartedAt || 0,
-    );
-    const stage = entry.stage || 'idle';
-    const waitingForFirstActivity = Boolean(
-        modelRequestStartedAt
-        && (stage === 'connecting' || stage === 'requesting')
-        && firstActivityAt <= modelRequestStartedAt
-    );
-    return {
-        stage,
-        askStartedAt,
-        modelRequestStartedAt,
-        firstActivityAt,
-        lastStreamDeltaAt: entry.lastStreamDeltaAt || 0,
-        toolStartedAt: entry.toolStartedAt || 0,
-        lastProgressAt: entry.lastProgressAt || 0,
-        updatedAt: entry.updatedAt || 0,
-        hasFirstActivity: Boolean(firstActivityAt && (!askStartedAt || firstActivityAt >= askStartedAt)),
-        waitingForFirstActivity,
-    };
-}
-
-/**
- * Iterate all active session runtimes. Used by the stream watchdog.
- * Returns an iterable of [sessionId, entry] pairs; consumers should
- * treat entries as read-only snapshots and avoid mutating them.
- */
-export function forEachSessionRuntime() {
-    return _runtimeState.entries();
-}
-
 // --- Incremental metric persistence (fix A) ---
-// Per-session idempotency tracking: sessionId → Set of seen turn:epoch:iteration:source keys.
-const _metricSeenIter = new Map();
-
-/** Monotonic per-session ask/turn id for incremental usage idempotency. */
-export function bumpUsageMetricsTurnId(session) {
-    if (!session || typeof session !== 'object') return 0;
-    const next = (Number(session.usageMetricsTurnId) || 0) + 1;
-    session.usageMetricsTurnId = next;
-    return next;
-}
-
-export function resolveUsageMetricsTurnId(session, delta = {}) {
-    if (delta.usageMetricsTurnId != null && Number.isFinite(Number(delta.usageMetricsTurnId))) {
-        return Number(delta.usageMetricsTurnId);
-    }
-    return Number(session?.usageMetricsTurnId) || 0;
-}
-
-/** Advance loop metrics epoch when agentLoop resets its iteration counter (post-compact). */
-export function bumpUsageMetricsEpoch(session) {
-    if (!session || typeof session !== 'object') return 0;
-    const next = (Number(session.usageMetricsEpoch) || 0) + 1;
-    session.usageMetricsEpoch = next;
-    return next;
-}
-
-/**
- * Resolve usage-metrics epoch for idempotency (exported for regression smoke).
- * Prefers session.usageMetricsEpoch (bumped in loop on compact reset) and optional
- * delta.usageMetricsEpoch; falls back to iteration regression when loop did not bump.
- */
-export function resolveUsageMetricsEpoch(session, delta = {}) {
-    if (!session) return 0;
-    let epoch = Number(session.usageMetricsEpoch) || 0;
-    if (delta.usageMetricsEpoch != null && Number.isFinite(Number(delta.usageMetricsEpoch))) {
-        epoch = Math.max(epoch, Number(delta.usageMetricsEpoch));
-    }
-    const idx = Number(delta.iterationIndex);
-    const prevLastIdx = typeof session.lastIterationIndex === 'number'
-        ? session.lastIterationIndex
-        : null;
-    if (
-        (delta.usageMetricsEpoch == null || !Number.isFinite(Number(delta.usageMetricsEpoch)))
-        && prevLastIdx !== null
-        && Number.isFinite(idx)
-        && idx < prevLastIdx
-    ) {
-        epoch += 1;
-    }
-    return epoch;
-}
-
-export function usageMetricsSourceKey(delta = {}) {
-    const raw = delta.source ?? delta.usageSource;
-    if (raw == null || raw === '') return 'provider_send';
-    return String(raw);
-}
-
-/** Idempotency key for incremental usage persistence (exported for regression smoke). */
-export function usageMetricsIdempotencyKey(sessionId, session, delta = {}) {
-    const turnId = resolveUsageMetricsTurnId(session, delta);
-    const epoch = resolveUsageMetricsEpoch(session, delta);
-    const source = usageMetricsSourceKey(delta);
-    return `${sessionId}:${turnId}:${epoch}:${delta.iterationIndex}:${source}`;
-}
-
-function uncachedInputTokensForProvider(provider, inputTokens, cachedReadTokens = 0, cacheWriteTokens = 0) {
-    const input = Number(inputTokens) || 0;
-    if (input <= 0) return 0;
-    // Anthropic-style providers report input_tokens excluding cache reads; OpenAI
-    // Responses/Gemini-style providers report input_tokens inclusive of cached
-    // prefix tokens. Keep both views so UI can show the real context footprint
-    // and the fresh/new token portion without mistaking cache hits for a cache
-    // break.
-    if (providerInputExcludesCache(provider)) return input + (Number(cacheWriteTokens) || 0);
-    return Math.max(input - (Number(cachedReadTokens) || 0) - (Number(cacheWriteTokens) || 0), 0);
-}
-
-/**
- * Apply terminal ask usage to session totals. Skips lifetime totals when incremental
- * per-iteration persistence already counted this turn (askSession path).
- */
-export function applyAskTerminalUsageTotals(session, result, options = {}) {
-    if (!session || !result?.usage) return;
-    const skipTotals = options.skipTotalsIfIncremental === true;
-    if (!skipTotals) {
-        const inputTokens = result.usage.inputTokens || 0;
-        const outputTokens = result.usage.outputTokens || 0;
-        const cachedTokens = result.usage.cachedTokens || 0;
-        const cacheWriteTokens = result.usage.cacheWriteTokens || 0;
-        const uncachedInputTokens = uncachedInputTokensForProvider(session.provider, inputTokens, cachedTokens, cacheWriteTokens);
-        session.totalInputTokens = (session.totalInputTokens || 0) + inputTokens;
-        session.totalOutputTokens = (session.totalOutputTokens || 0) + outputTokens;
-        session.tokensCumulative = (session.tokensCumulative || 0)
-            + inputTokens
-            + outputTokens;
-        session.totalCachedReadTokens = (session.totalCachedReadTokens || 0) + cachedTokens;
-        session.totalCacheWriteTokens = (session.totalCacheWriteTokens || 0) + cacheWriteTokens;
-        session.totalUncachedInputTokens = (session.totalUncachedInputTokens || 0) + uncachedInputTokens;
-    }
-    const _lastTurn = result.lastTurnUsage || result.usage || {};
-    const _lastInputTokens = _lastTurn.inputTokens || 0;
-    const _lastCachedReadTokens = _lastTurn.cachedTokens || 0;
-    const _lastCacheWriteTokens = _lastTurn.cacheWriteTokens || 0;
-    session.lastInputTokens = _lastInputTokens;
-    session.lastOutputTokens = _lastTurn.outputTokens || 0;
-    session.lastCachedReadTokens = _lastCachedReadTokens;
-    session.lastCacheWriteTokens = _lastCacheWriteTokens;
-    session.lastUncachedInputTokens = uncachedInputTokensForProvider(
-        session.provider,
-        _lastInputTokens,
-        _lastCachedReadTokens,
-        _lastCacheWriteTokens,
-    );
-    const _inputExcludesCache = providerInputExcludesCache(session.provider);
-    session.lastContextTokens = _inputExcludesCache
-        ? _lastInputTokens + _lastCachedReadTokens + _lastCacheWriteTokens
-        : _lastInputTokens;
-    session.lastContextTokensUpdatedAt = Date.now();
-    session.lastContextTokensStaleAfterCompact = false;
-}
-
-/**
- * Persist incremental usage delta immediately after each provider.send iteration.
- * Idempotency key `sessionId:turnId:epoch:iterationIndex:source` scopes retries
- * per ask, compaction epoch, iteration, and usage source.
- */
-export async function persistIterationMetrics(delta) {
-    if (!delta || !delta.sessionId) return;
-    const { sessionId, iterationIndex, deltaInput, deltaOutput, deltaCachedRead, deltaCacheWrite, ts } = delta;
-    const runtimeEntry = _runtimeState.get(sessionId);
-    const session = runtimeEntry?.session ?? loadSession(sessionId);
-    if (!session || session.closed) return;
-    const epoch = resolveUsageMetricsEpoch(session, delta);
-    if (epoch !== (Number(session.usageMetricsEpoch) || 0)) {
-        session.usageMetricsEpoch = epoch;
-    }
-    let seen = _metricSeenIter.get(sessionId);
-    if (!seen) {
-        seen = new Set();
-        _metricSeenIter.set(sessionId, seen);
-    }
-    const ikey = usageMetricsIdempotencyKey(sessionId, session, delta);
-    const isReplay = seen.has(ikey);
-    seen.add(ikey);
-    if (!isReplay) {
-        if (runtimeEntry) runtimeEntry.usageMetricsTurnIncremental = true;
-        const deltaUncachedInput = delta.deltaUncachedInput != null
-            ? Number(delta.deltaUncachedInput) || 0
-            : uncachedInputTokensForProvider(session.provider, deltaInput, deltaCachedRead, deltaCacheWrite);
-        session.totalInputTokens = (session.totalInputTokens || 0) + (deltaInput || 0);
-        session.totalOutputTokens = (session.totalOutputTokens || 0) + (deltaOutput || 0);
-        session.tokensCumulative = (session.tokensCumulative || 0) + (deltaInput || 0) + (deltaOutput || 0);
-        // Cache totals — additive fields, default 0 on legacy sessions; both
-        // are undefined-safe so the schema migrates lazily as new iterations
-        // land. Keeps live + terminal aggregates in lock-step (loop.mjs already
-        // includes cached_read / cache_write in its terminal usage rollup).
-        session.totalCachedReadTokens = (session.totalCachedReadTokens || 0) + (deltaCachedRead || 0);
-        session.totalCacheWriteTokens = (session.totalCacheWriteTokens || 0) + (deltaCacheWrite || 0);
-        session.totalUncachedInputTokens = (session.totalUncachedInputTokens || 0) + deltaUncachedInput;
-        // Window snapshot updated per iteration so agent type=list reflects the
-        // most-recent provider-reported input size even for short dispatches
-        // that finish before askSession's terminal save lands.
-        session.lastInputTokens = deltaInput || 0;
-        session.lastOutputTokens = deltaOutput || 0;
-        session.lastCachedReadTokens = deltaCachedRead || 0;
-        session.lastCacheWriteTokens = deltaCacheWrite || 0;
-        session.lastUncachedInputTokens = deltaUncachedInput;
-        // Normalized last-call context footprint: how many prompt tokens the
-        // model actually saw on the most-recent send, comparable ACROSS
-        // providers. Anthropic reports input_tokens EXCLUDING cache (cache_read
-        // is a separate field), so the cached portion must be added back to
-        // reflect real context size; openai/grok/gemini already fold cached
-        // tokens INTO the input count, so input alone is the footprint.
-        const _inputExcludesCache = providerInputExcludesCache(session.provider);
-        session.lastContextTokens = _inputExcludesCache
-            ? (deltaInput || 0) + (deltaCachedRead || 0) + (deltaCacheWrite || 0)
-            : (deltaInput || 0);
-        session.lastContextTokensUpdatedAt = ts || Date.now();
-        session.lastContextTokensStaleAfterCompact = false;
-    }
-    session.lastIterationIndex = iterationIndex;
-    session.updatedAt = ts || Date.now();
-    await saveSessionAsync(session, { expectedGeneration: session.generation });
-}
-
-function standaloneStatusRouteInfo(session) {
-    if (!session) return null;
-    // autoCompactTokenLimit is an EXPLICIT sub-boundary auto-compact limit only.
-    // Do NOT fall back to compactBoundaryTokens/contextWindow here — that
-    // labels a derived full-window value as an explicit limit, which the
-    // runtime would treat as the compaction trigger and collapse the buffer.
-    // The boundary/window stays available via contextWindow/rawContextWindow.
-    const _boundary = Number(session.compactBoundaryTokens || session.contextWindow || 0);
-    const _limit = Number(session.autoCompactTokenLimit || 0);
-    const explicitAutoCompactTokenLimit = _limit > 0 && (!_boundary || _limit < _boundary) ? _limit : null;
-    return {
-        provider: session.provider,
-        model: session.model,
-        modelDisplay: session.modelDisplay || session.displayName || session.model,
-        effort: session.effort || '',
-        fast: session.fast === true,
-        contextWindow: session.contextWindow || null,
-        rawContextWindow: session.rawContextWindow || session.contextWindow || null,
-        effectiveContextWindowPercent: session.effectiveContextWindowPercent || null,
-        autoCompactTokenLimit: explicitAutoCompactTokenLimit,
-        presetId: session.presetId || null,
-        presetName: session.presetName || null,
-    };
-}
-
-function recordStandaloneStatusTelemetry(session, result, durationMs) {
-    if (!session || !result?.usage) return;
-    const routeInfo = standaloneStatusRouteInfo(session);
-    if (!routeInfo?.provider || !routeInfo?.model) return;
-    const providerOut = {
-        usage: result.usage,
-        model: result.model,
-        serviceTier: result.serviceTier,
-    };
-    // The transcript estimate is the SSOT for the displayed context footprint.
-    // agentLoop()'s result has no `compact` field, so build a synthetic compact
-    // arg carrying the live monotonic estimate (estimateMessagesTokens+reserve)
-    // as afterTokens. This lights up summarizeGatewayUsage's estimate-based
-    // contextUsedPct branch (provider input_tokens swing wildly / unbounded on
-    // e.g. OpenAI gpt-5.5), and lets a genuine >100% pass through.
-    const _estTokens = estimateTranscriptContextUsage(session.messages, session.tools || []);
-    const _compactArg = { ...(result.compact && typeof result.compact === 'object' ? result.compact : {}), afterTokens: _estTokens };
-    try {
-        const summary = {
-            ...summarizeGatewayUsage(routeInfo, providerOut, _compactArg, durationMs),
-            requestKind: 'chat',
-            sessionId: session.id || null,
-            toolCount: result.toolCallsTotal ?? null,
-            messageCount: Array.isArray(session.messages) ? session.messages.length : null,
-            cacheStrategy: session.providerCacheOpts?.cacheStrategy || null,
-        };
-        recordGatewayUsageEvent(summary);
-    } catch {
-        // Statusline telemetry must never affect the model turn.
-    }
-
-    const provider = getProvider(routeInfo.provider);
-    if (!provider) return;
-    fetchOAuthUsageSnapshot(routeInfo, provider, (message) => {
-        if (process.env.MIXDOG_STATUSLINE_TRACE) {
-            process.stderr.write(`[statusline] ${message}\n`);
-        }
-    })
-        .then((snapshot) => {
-            try { buildGatewayLimits(routeInfo, providerOut, snapshot); } catch {}
-        })
-        .catch(() => {});
-}
+// Usage-metrics accounting (idempotency Set, epoch/turn helpers, terminal +
+// incremental persistence) moved to manager/usage-metrics.mjs. Its runtime
+// accessor is now wired inside manager/runtime-liveness.mjs (which owns the
+// _runtimeState Map), so persistIterationMetrics can read the live in-memory
+// session and flag usageMetricsTurnIncremental.
+//
+// standaloneStatusRouteInfo + recordStandaloneStatusTelemetry moved to
+// manager/status-telemetry.mjs (imported above).
 
 /** Force-flush session metrics to disk. Used by watchdog terminal-reap (fix B). */
 export async function flushSessionMetrics(sessionId) {
@@ -1801,91 +945,6 @@ export async function flushSessionMetrics(sessionId) {
     await saveSessionAsync(session, { expectedGeneration: session.generation });
 }
 
-/** Mark session hidden so listSessions() filters it out (runtime-only). */
-export function hideSessionFromList(sessionId) {
-    if (!sessionId) return;
-    const entry = _runtimeState.get(sessionId);
-    if (entry) entry.listHidden = true;
-}
-
-export function getSessionAbortSignal(sessionId) {
-    return _runtimeState.get(sessionId)?.controller?.signal ?? null;
-}
-
-/**
- * Return the most recent "session is making progress" timestamp.
- *
- * Combines three independent progress signals so an idle watchdog can stay
- * alive across both streaming and long tool calls:
- *   - lastStreamDeltaAt: provider stream chunk landed
- *   - toolStartedAt: a tool call just kicked off (nested tool work may
- *     stall the outer stream for a while; this keeps the watchdog from
- *     killing legitimate sub-agent runs)
- *   - askStartedAt: ask just started; covers the pre-stream connect window
- *
- * Returns 0 when the runtime entry is unknown so callers can decide to
- * either skip the watchdog or treat 0 as "no progress yet".
- */
-export function getSessionLastProgressAt(sessionId) {
-    const entry = _runtimeState.get(sessionId);
-    if (!entry) return 0;
-    return Math.max(
-        entry.lastProgressAt || 0,
-        entry.lastStreamDeltaAt || 0,
-        entry.toolStartedAt || 0,
-        entry.askStartedAt || 0,
-    );
-}
-
-/**
- * Link a parent AbortSignal to a sub-session's controller so that aborting
- * the parent (fan-out deadline or caller ESC) tears down the agent role's
- * provider call promptly. Safe to call after prepareAgentSession but before
- * askSession completes. No-op if the session runtime isn't found.
- *
- * @param {string} sessionId — the sub-session to abort
- * @param {AbortSignal} parentSignal — upstream signal (from fan-out coordinator)
- */
-export function linkParentSignalToSession(sessionId, parentSignal) {
-    if (!(parentSignal instanceof AbortSignal)) return;
-    const entry = _touchRuntime(sessionId);
-    if (!entry.controller) entry.controller = createAbortController();
-    const abortReason = () => {
-        const reason = parentSignal.reason;
-        if (reason instanceof Error) return reason;
-        if (reason !== undefined && reason !== null && reason !== '') return new Error(String(reason));
-        return new Error('parent signal aborted');
-    };
-    if (parentSignal.aborted) {
-        _unlinkParentAbortListener(entry);
-        try { entry.controller.abort(abortReason()); } catch { /* ignore */ }
-        return;
-    }
-    _unlinkParentAbortListener(entry);
-    const onParentAbort = () => {
-        try { entry.controller?.abort(abortReason()); } catch { /* ignore */ }
-    };
-    parentSignal.addEventListener('abort', onParentAbort, { once: true });
-    entry.parentAbortLink = { signal: parentSignal, listener: onParentAbort };
-}
-function _unlinkParentAbortListener(entry) {
-    const link = entry?.parentAbortLink;
-    if (!link) return;
-    try { link.signal.removeEventListener('abort', link.listener); } catch { /* ignore */ }
-    entry.parentAbortLink = null;
-}
-function _clearSessionRuntime(id) {
-    if (id) {
-        _stopToolActivityHeartbeat(id);
-        _unlinkParentAbortListener(_runtimeState.get(id));
-        _runtimeState.delete(id);
-        // R15: also drop the per-session metric-idempotency Set; otherwise it
-        // grows O(sessions x iterations) for the whole server lifetime since
-        // nothing else deletes from _metricSeenIter on session close.
-        _metricSeenIter.delete(id);
-    }
-}
-
 /**
  * Wrap an async call so that if the session's controller aborts mid-flight,
  * the wrapper settles with a SessionClosedError even if the underlying promise
@@ -2081,7 +1140,7 @@ async function persistCompactedOutgoingAfterAskFailure({
 }) {
     if (!activeSession || activeSession.closed === true) return;
     if (!Array.isArray(turnOutgoing) || turnOutgoing.length === 0) return;
-    const currentRuntime = _runtimeState.get(sessionId);
+    const currentRuntime = _getRuntimeEntry(sessionId);
     if (currentRuntime?.closed || currentRuntime?.generation !== askGeneration) return;
     const sanitized = sanitizeSessionMessagesForModel(turnOutgoing);
     const priorSanitized = sanitizeSessionMessagesForModel(
@@ -2159,7 +1218,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
             }
         }
         if (!hasModelVisiblePromptContent(prompt)) {
-            _unlinkParentAbortListener(_runtimeState.get(sessionId));
+            _unlinkParentAbortListener(_getRuntimeEntry(sessionId));
             return _result;
         }
         // ── Synchronous pre-await setup (must happen before any await so
@@ -2389,7 +1448,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
             }
             // Post-loop validation: if closeSession() landed while we were awaiting,
             // drop the save so the tombstone on disk isn't overwritten.
-            const currentRuntime = _runtimeState.get(sessionId);
+            const currentRuntime = _getRuntimeEntry(sessionId);
             if (currentRuntime?.closed || currentRuntime?.generation !== askGeneration) {
                 const reason = currentRuntime?.closedReason;
                 throw new SessionClosedError(sessionId, `closed during call (reason=${reason || 'unknown'})`, reason || null);
@@ -2605,7 +1664,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
             // stale in-flight array once the turn unwinds.
             if (activeSession) activeSession.liveTurnMessages = null;
             if (err instanceof SessionClosedError) {
-                const currentRuntime = _runtimeState.get(sessionId);
+                const currentRuntime = _getRuntimeEntry(sessionId);
                 if (!currentRuntime?.closed) {
                     if (activeSession) {
                         const originalMessages = Array.isArray(activeSession.messages) ? activeSession.messages : [];
@@ -2673,14 +1732,14 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                 continue;
             }
         }
-        _unlinkParentAbortListener(_runtimeState.get(sessionId));
+        _unlinkParentAbortListener(_getRuntimeEntry(sessionId));
         return _result;
       }
     } finally {
         // Clear the controller only if it's still ours (closeSession may have
         // swapped it). Leave the rest of the runtime entry intact so agent type=list
         // can still surface the final stage (done/error/cancelling).
-        const entry = _runtimeState.get(sessionId);
+        const entry = _getRuntimeEntry(sessionId);
         if (entry && entry.generation === askGeneration) {
             _unlinkParentAbortListener(entry);
             entry.controller = null;
@@ -2759,7 +1818,7 @@ export function getSession(id) {
 export function listSessions(opts = {}) {
     const includeClosed = opts.includeClosed === true;
     const sessions = listStoredSessionSummaries();
-    const hiddenIds = new Set([..._runtimeState.entries()].filter(([, e]) => e.listHidden).map(([id]) => id));
+    const hiddenIds = new Set([..._runtimeEntries()].filter(([, e]) => e.listHidden).map(([id]) => id));
     // Tombstoned sessions (closed===true) are excluded unless the caller opts in
     // (e.g. agent list includeClosed:true).
     return sessions.filter(s => !hiddenIds.has(s.id) && (includeClosed || s.closed !== true));
@@ -2846,6 +1905,7 @@ export async function clearSessionMessages(sessionId, options = {}) {
     const afterTokens = estimateTranscriptContextUsage(keep, session.tools || []);
     const now = Date.now();
     session.messages = keep;
+    session.sessionStartMetaInjected = false;
     session.totalInputTokens = 0;
     session.totalOutputTokens = 0;
     session.totalCachedReadTokens = 0;
@@ -2935,12 +1995,21 @@ export async function updateSessionStatus(id, status) {
  * Long-term cleanup: `sweepTombstones()` below unlinks tombstones older than
  * TOMBSTONE_MAX_AGE_MS (24h — vastly longer than any realistic in-flight race).
  */
-export function closeSession(id, reason = 'manual') {
+export function closeSession(id, reason = 'manual', opts = {}) {
+    // tombstone=false: detach runtime resources (heartbeat, bash shells,
+    // controller abort, runtime-map clear) WITHOUT planting the disk
+    // tombstone. Used for non-empty sessions on /resume-away, /new, and
+    // TUI exit — previously every one of those paths unconditionally
+    // tombstoned the outgoing session, which made it vanish from the
+    // Resume list immediately and get hard-deleted by sweepTombstones()
+    // after 24h even though it had real conversation content worth
+    // resuming. Only truly-empty scratch sessions should still tombstone.
+    const tombstone = opts.tombstone !== false;
     if (!id) return false;
     _stopToolActivityHeartbeat(id);
     // Prefer in-memory runtime session — allBashSessionIds may not be persisted
     // yet for shells opened in the current turn (BL-bash-disk-sync).
-    const inMemory = _runtimeState.get(id)?.session;
+    const inMemory = _getRuntimeEntry(id)?.session;
     const persisted = inMemory || loadSession(id);
     const bashSessionId = persisted?.implicitBashSessionId || null;
     // Collect all persistent bash shells created during this session.
@@ -2951,9 +2020,19 @@ export function closeSession(id, reason = 'manual') {
     // against old session records that only have implicitBashSessionId.
     if (bashSessionId && !allBashIds.includes(bashSessionId)) allBashIds.push(bashSessionId);
     // 1. Tombstone first — this wins the race against saveSession().
-    const newGen = markSessionClosed(id, reason);
+    //    Skipped when tombstone=false: no closed:true marker is planted, so
+    //    the session file stays intact and resumeSession() will accept it.
+    //    We still bump the on-disk generation via bumpSessionGeneration() —
+    //    that alone is what protects the session from a late save race: any
+    //    saveSession() still in flight from this detached turn (e.g. the
+    //    cancel-cleanup save below) carries the OLD generation as its
+    //    expectedGeneration, so _shouldDrop()'s ownership-counter rule drops
+    //    it once disk generation moves past that. Without this bump the late
+    //    write could silently overwrite the session after the user resumes
+    //    it back (BL: burned-session late-save clobber).
+    const newGen = tombstone ? markSessionClosed(id, reason) : bumpSessionGeneration(id, reason);
     // 2. Mark runtime as closed so post-await validation in askSession fires.
-    const entry = _runtimeState.get(id);
+    const entry = _getRuntimeEntry(id);
     if (entry) {
         entry.closed = true;
         entry.closedReason = reason;
@@ -2972,7 +2051,7 @@ export function closeSession(id, reason = 'manual') {
     try {
         const askStartedAt = entry?.askStartedAt;
         const durationMs = (typeof askStartedAt === 'number') ? (Date.now() - askStartedAt) : null;
-        const parts = [`session=${id}`, `reason=${reason}`];
+        const parts = [`session=${id}`, `reason=${reason}`, `tombstone=${tombstone}`];
         if (durationMs != null) parts.push(`duration=${durationMs}ms`);
         if (process.env.MIXDOG_DEBUG_SESSION_LOG) process.stderr.write(`[agent-close] ${parts.join(' ')}\n`);
     } catch { /* best-effort */ }
@@ -3002,7 +2081,7 @@ export function closeSession(id, reason = 'manual') {
 export function abortSessionTurn(id, reason = 'turn-abort') {
     if (!id) return false;
     _stopToolActivityHeartbeat(id);
-    const entry = _runtimeState.get(id);
+    const entry = _getRuntimeEntry(id);
     if (!entry || entry.closed) return false;
     entry.stage = 'cancelling';
     entry.closedReason = reason;
@@ -3052,7 +2131,7 @@ function sweepIdleSessions({ includeTombstones = true } = {}) {
                 // Skip entries with an active in-flight controller — aborting
                 // them via closeSession() is the safe path; clearing the runtime
                 // without signalling the controller leaves orphan provider work.
-                const rtEntry = _runtimeState.get(d.id);
+                const rtEntry = _getRuntimeEntry(d.id);
                 if (rtEntry && rtEntry.controller && !rtEntry.controller.signal?.aborted) {
                     try { closeSession(d.id, 'idle-sweep'); } catch { /* ignore */ }
                 } else {
@@ -3120,7 +2199,7 @@ export function sweepTombstones() {
 }
 
 function hasActiveRuntimeWork() {
-    for (const [, entry] of _runtimeState) {
+    for (const [, entry] of _runtimeEntries()) {
         if (!entry || entry.closed === true) continue;
         if (entry.controller && !entry.controller.signal?.aborted) return true;
         if (['connecting', 'requesting', 'streaming', 'tool_running', 'cancelling'].includes(entry.stage)) return true;