mixdog 0.9.36 → 0.9.38

package/src/session-runtime/runtime-core.mjs

@@ -306,6 +306,26 @@ export function __saveModelSettingsForTest(cfgMod, route, options = {}) {
   return saveModelSettings(cfgMod, route, options);
 }
 
+// Decide whether notifyFnForSession should mirror a terminal tool completion
+// into the pending-message queue. Only the TUI execution-ui path actually
+// injects the model-visible twin of the completion into the active loop, and it
+// signals that with an EXPLICIT ack (modelVisibleDelivered) — never a generic
+// truthy onNotification return. Skipping the mirror on a bare `handled===true`
+// would let a display-only / API listener suppress the sole model-visible copy,
+// so the model would never see the completion body. Mirror UNLESS the body was
+// explicitly delivered; unknown/generic-handled → keep the mirror.
+export function shouldMirrorCompletionToPendingQueue({
+  callerSessionId,
+  modelVisibleDelivered,
+  hasEnqueue,
+  text,
+  meta = {},
+} = {}) {
+  if (!callerSessionId || !hasEnqueue) return false;
+  if (modelVisibleDelivered) return false;
+  return shouldPersistModelVisibleToolCompletion(text, meta);
+}
+
 export async function createMixdogSessionRuntime({
   provider,
   model,
@@ -713,7 +733,7 @@ export async function createMixdogSessionRuntime({
       // available / installs on quit" nag while the background stage runs
       // silently. The wording lives in the notice surface (notification-plan):
       // this emit only carries meta.version. TUI maps meta.kind 'update-notice'
-      // to a transcript notice, never a model-visible message; tone 'info' =
+      // to a transient notice, never a model-visible message; tone 'info' =
       // non-urgent, applies on the next launch.
       const announceReady = () => {
         emitRuntimeNotification('update ready', { kind: 'update-notice', version: ver, tone: 'info' });
@@ -742,7 +762,7 @@ export async function createMixdogSessionRuntime({
 
   function emitRuntimeNotification(content, meta = {}) {
     const text = String(content || '').trim();
-    if (!text) return false;
+    if (!text) return { handled: false, modelVisibleDelivered: false };
     const event = { content: text, meta: meta && typeof meta === 'object' ? meta : {} };
     let handled = false;
     for (const listener of [...notificationListeners]) {
@@ -750,19 +770,34 @@ export async function createMixdogSessionRuntime({
         if (listener(event) === true) handled = true;
       } catch {}
     }
-    return handled;
+    // EXPLICIT model-visible-delivery ack: only the TUI execution-ui path sets
+    // event.modelVisibleDelivered when it enqueues the model-visible completion
+    // body into the active loop. A generic display-only / API listener that
+    // returns true does NOT set it, so `handled` alone must never be read as
+    // "the model saw the body".
+    const modelVisibleDelivered = event.modelVisibleDelivered === true;
+    return { handled, modelVisibleDelivered };
   }
 
   function notifyFnForSession(callerSessionId) {
     return (text, meta = {}) => {
-      const handledByRuntimeListener = emitRuntimeNotification(text, meta);
+      const { handled: handledByRuntimeListener, modelVisibleDelivered } = emitRuntimeNotification(text, meta);
       let enqueued = false;
       // TUI sessions consume raw execution notifications for UI/task cards via
       // onNotification, but those raw envelopes are internal-only in pending
-      // drain. Always mirror terminal completions with a model-visible wrapper
-      // while keeping the raw text for UI display.
-      if (callerSessionId && typeof mgr.enqueuePendingMessage === 'function'
-        && shouldPersistModelVisibleToolCompletion(text, meta)) {
+      // drain. The TUI execution-ui path injects the model-visible twin of a
+      // terminal completion into the active loop and acks with
+      // modelVisibleDelivered, so mirroring it into the pending queue would
+      // double-inject the same completion — skip only on that EXPLICIT ack. A
+      // generic display-only / API listener returning true is NOT an ack: the
+      // mirror stays as the sole model-visible delivery.
+      if (shouldMirrorCompletionToPendingQueue({
+        callerSessionId,
+        modelVisibleDelivered,
+        hasEnqueue: typeof mgr.enqueuePendingMessage === 'function',
+        text,
+        meta,
+      })) {
         try {
           const visible = modelVisibleToolCompletionMessage(text, meta);
           // Terminal completion (gated by shouldPersistModelVisibleToolCompletion)
@@ -973,7 +1008,7 @@ export async function createMixdogSessionRuntime({
       const meta = params.meta && typeof params.meta === 'object' ? params.meta : {};
       const content = channelNotificationModelContent(params);
       if (!content) return;
-      const handled = emitRuntimeNotification(content, meta);
+      const { handled } = emitRuntimeNotification(content, meta);
       if (!handled && session?.id && shouldMirrorChannelNotificationToPending(meta)) {
         try { mgr.enqueuePendingMessage(session.id, content); } catch {}
       }
@@ -1228,7 +1263,15 @@ export async function createMixdogSessionRuntime({
     if (!startupProviderCatalogRefreshStarted && !closeRequested) {
       startupProviderCatalogRefreshStarted = true;
       try {
-        reg.refreshProviderCatalogsOnStartup();
+        void Promise.resolve(reg.refreshProviderCatalogsOnStartup())
+          .then(() => {
+            invalidateProviderCaches();
+            warmProviderModelCache();
+            bootProfile('provider-catalogs:refresh-ready');
+          })
+          .catch((error) => {
+            bootProfile('provider-catalogs:refresh-failed', { error: error?.message || String(error) });
+          });
         bootProfile('provider-catalogs:refresh-started');
       } catch (error) {
         bootProfile('provider-catalogs:refresh-failed', { error: error?.message || String(error) });
@@ -2102,6 +2145,9 @@ export async function createMixdogSessionRuntime({
     scheduleStatuslineUsageRefresh,
     invalidateContextStatusCache,
     invalidateProviderCaches,
+    createCurrentSession,
+    invalidatePreSessionToolSurface,
+    pushTranscriptRebind,
     collectSearchProviderModels,
   });
   const workflowAgentsApi = createWorkflowAgentsApi({

package/src/session-runtime/settings-api.mjs

@@ -122,7 +122,12 @@ export function createSettingsApi({
     // language catalog entry and the full language list for the picker UI.
     getProfile() {
       const config = getConfig();
-      const profile = cfgMod.normalizeProfileConfig(config.profile);
+      // In-memory config is flat: `config.profile` is what the save path
+      // (buildAgentSaveBuilder) persists into the on-disk `agent.profile`
+      // slot. Fall back to a nested `agent.profile` only for any stray
+      // nested snapshot.
+      const stored = config?.profile ?? config?.agent?.profile;
+      const profile = cfgMod.normalizeProfileConfig(stored);
       return {
         ...profile,
         languageEntry: cfgMod.profileLanguageEntry(profile.language),
@@ -152,7 +157,7 @@ export function createSettingsApi({
     },
     setProfile(input = {}) {
       const config = getConfig();
-      const current = cfgMod.normalizeProfileConfig(config.profile);
+      const current = cfgMod.normalizeProfileConfig(config?.profile ?? config?.agent?.profile);
       const next = { ...current };
       if (hasOwn(input, 'title') || hasOwn(input, 'name')) {
         next.title = input.title ?? input.name ?? '';
@@ -161,6 +166,10 @@ export function createSettingsApi({
         next.language = input.language ?? input.lang ?? 'system';
       }
       const normalized = cfgMod.normalizeProfileConfig(next);
+      // Persist flat: buildAgentSaveBuilder (config.mjs saveConfig) reads
+      // `config.profile` and writes it into the on-disk `agent.profile`
+      // section, which the prompt builder (readAgentConfig) reads. Writing a
+      // nested `agent.profile` here would be dropped by the save path.
       saveConfigAndAdopt({ ...config, profile: normalized });
       return this.getProfile();
     },

package/src/session-runtime/warmup-schedulers.mjs

@@ -102,7 +102,13 @@ export function createWarmupSchedulers({
         scheduleProviderModelWarmup(backgroundBusyRetryMs);
         return;
       }
-      warmProviderModelCache();
+      if (!isFirstTurnCompleted() && !envFlag('MIXDOG_PROVIDER_WARMUP_BEFORE_FIRST_TURN')) {
+        bootProfile('provider-models:warm-deferred', { reason: 'first-turn-pending' });
+        warmProviderModelCache();
+        scheduleProviderModelWarmup(backgroundBusyRetryMs);
+        return;
+      }
+      warmProviderModelCache({ loadSecrets: true });
     }, delayMs);
     timers.providerModelWarmupTimer.unref?.();
   }

package/src/standalone/agent-tool.mjs

@@ -14,6 +14,7 @@ import {
 import { presentErrorText, errorLine } from '../runtime/shared/err-text.mjs';
 import { updateJsonAtomicSync } from '../runtime/shared/atomic-file.mjs';
 import { normalizeAgentPermission } from '../runtime/shared/markdown-frontmatter.mjs';
+import { ensureProcessListenerHeadroom } from '../runtime/shared/process-listener-headroom.mjs';
 import { prepareAgentSession } from '../runtime/agent/orchestrator/agent-runtime/session-builder.mjs';
 import {
   abortAgentProgressWatchdog,
@@ -63,6 +64,8 @@ import { createNotify } from './agent-tool/notify.mjs';
 // identical public surface (`import { AGENT_TOOL } from './agent-tool.mjs'`).
 export { AGENT_TOOL };
 
+ensureProcessListenerHeadroom(64);
+
 const STANDALONE_SOURCE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 
 // Grace window during which a terminated/idle worker row is kept around so the
@@ -98,15 +101,18 @@ const DEFAULT_SPAWN_PREP_TIMEOUT_MS = envTimeoutMs('MIXDOG_AGENT_SPAWN_PREP_TIME
 
 // Global spawn-start stagger: unlimited-N parallel fan-out otherwise fires all
 // first provider calls in the same instant, racing the server-side prompt-
-// cache write/propagation window. Bench (parallel-10, identical-ms starts):
-// 12.5% cache miss; 3000ms lane stagger: 4.3%; 166ms: 6.0%. 1000ms default
-// picked as a low-cost middle ground. Chain (not a fixed lane count) so it
-// scales to any N: each new spawn's start is pushed to at least STAGGER_MS
-// after the previous spawn's start; sequential/non-overlapping spawns (now
-// already past the window) pay zero added latency. MIXDOG_SPAWN_STAGGER_MS=0
-// disables. Applied inside the deferred job body (see startDeferredSpawnJob)
-// so the agent tool call itself still returns task_id immediately.
-const SPAWN_STAGGER_MS = envTimeoutMs('MIXDOG_SPAWN_STAGGER_MS', 1000);
+// cache write/propagation window. Default 0 (off): mirrors the explore fan-out
+// finding — the first spawn's prompt-cache write only lands after its iter1
+// completes (~seconds), so a sub-second stagger yields ~no cross-spawn cache
+// reads while charging every later spawn the full delay, i.e. pure fan-out
+// latency for negligible hit-rate gain. Kept as a knob for tuning: set
+// MIXDOG_SPAWN_STAGGER_MS>0 to re-enable. When >0 it chains (not a fixed lane
+// count) so it scales to any N: each new spawn's start is pushed to at least
+// STAGGER_MS after the previous spawn's start; sequential/non-overlapping
+// spawns pay zero added latency. Applied inside the deferred job body (see
+// startDeferredSpawnJob) so the agent tool call itself still returns task_id
+// immediately.
+const SPAWN_STAGGER_MS = envTimeoutMs('MIXDOG_SPAWN_STAGGER_MS', 0);
 let lastSpawnStartAt = 0;
 async function waitForSpawnStagger() {
   if (SPAWN_STAGGER_MS <= 0) return;

package/src/standalone/explore-tool.mjs

@@ -5,6 +5,9 @@ import { makeAgentDispatch } from '../runtime/agent/orchestrator/agent-runtime/a
 import { loadConfig } from '../runtime/agent/orchestrator/config.mjs';
 import { initProviders } from '../runtime/agent/orchestrator/providers/registry.mjs';
 import { presentErrorText } from '../runtime/shared/err-text.mjs';
+import { ensureProcessListenerHeadroom } from '../runtime/shared/process-listener-headroom.mjs';
+
+ensureProcessListenerHeadroom(64);
 
 // Ported from the original mixdog tool-defs.mjs `explore` entry.
 // `aiWrapped` is dropped: in the standalone build there is no aiWrapped
@@ -89,7 +92,7 @@ function escapeXml(str) {
 // reminder. The full no-verdict contract lives at system level
 // (rules/agent/30-explorer.md).
 export function buildExplorerPrompt(query) {
-  return `<query>${escapeXml(query)}</query>\nReminder: RULE ZERO is a binary gate after every tool result: >=1 path:line matching a SPECIFIC query token (product/library/domain name) -> answer NOW with those exact coordinates; zero -> one more batch if budget remains. A generic-word-only match (schema, handler, config, resolver, index, error...) while the query's specific tokens match nowhere counts as ZERO, not a hit. There is no third branch: "hits exist but I want better ones" IS branch one — answer now. A code_graph symbol hit (find_symbol/symbol_search returning path:line) IS an anchor — emit it directly, never re-locate it with grep. Credibility is mechanical (specific-token match), never judged: "is this the real implementation / final handler / just a wrapper" are caller questions, FORBIDDEN here; mark weak anchors ? and answer anyway. Flow/how/trigger queries: first matching definition/entry anchors ARE the complete answer — never trace the chain, one anchor per concept. You locate WHERE, never WHY. Scope is ALWAYS the session working directory: omit path or pass only a path seen in an earlier result; inventing a directory (/workspace/..., another repo's layout) is a defect — on zero hits change TOKENS, never guess paths. HARD max 3 tool turns; counter line (turn 1/3, turn 2/3, turn 3/3) on every tool message; expected shape is turn 1 -> answer, turns 2-3 are miss-recovery only (previous turn had ZERO matching lines), with changed tokens; after turn 3/3 you MUST answer best-so-far. Each turn = ONE maximal batch: a single grep whose pattern[] packs ALL token variants PLUS code_graph/find/glob in the SAME message; a single-tool turn is a wasted turn. Before emitting EXPLORATION_FAILED re-scan ALL earlier results: any line matching a specific query token -> answer with that anchor (? if weak) — a weak anchor beats a false miss; EXPLORATION_FAILED only when all 3 turns found zero token-matching lines. Output only anchor lines formatted as path:line — symbol/name — short reason, max 3 lines, or EXPLORATION_FAILED. No preamble, bullets, numbering, headings, summary, code quotes, analysis, verdicts, ratings, or recommendations.`;
+  return `<query>${escapeXml(query)}</query>\nReminder: BUDGET = TWO MESSAGES NORMALLY: message 1 = your multi-tool batch, message 2 = your answer text. A 3rd message (ANY extra tool call) is a DEFECT unless message 1 returned ZERO specific-token lines — extra code_graph/grep calls to confirm or upgrade an anchor you already hold are the single biggest source of overspend. TURN 1 IS ONE BATCH, NON-NEGOTIABLE: your FIRST tool message fires, in that single message together, grep (pattern[] packing 3-6 token variants) AND code_graph symbol_search (identifiers) AND find/glob (path/name fragments) — never emit grep alone and wait for its result before adding code_graph/find. Serial one-tool-per-turn is the #1 budget defect and forfeits the turn-1 -> answer path; a first turn that is not this multi-tool batch is malformed. After that batch returns, if ANY line carries a specific query token you MUST emit the ANSWER as your very next message: a further tool call to refine, confirm, or upgrade is the primary overspend defect — a second tool turn is legal ONLY when the batch returned ZERO specific-token lines. Then RULE ZERO is a binary gate after every tool result: >=1 path:line matching a SPECIFIC query token (product/library/domain name) -> STOP and answer NOW with those exact coordinates, this IS your final turn; zero -> one more batch if budget remains. Turns 2-3 exist SOLELY as zero-hit recovery (the previous turn matched ZERO specific tokens); spending a turn to confirm, refine, or upgrade an anchor you already hold is a defect. A generic-word-only match (schema, handler, config, resolver, index, error...) while the query's specific tokens match nowhere counts as ZERO, not a hit. There is no third branch: "hits exist but I want better ones" IS branch one — answer now. A code_graph symbol hit (find_symbol/symbol_search returning path:line) IS an anchor — emit it directly, never re-locate it with grep. Credibility is mechanical (specific-token match), never judged: "is this the real implementation / final handler / just a wrapper" are caller questions, FORBIDDEN here; mark weak anchors ? and answer anyway. Flow/how/trigger queries: first matching definition/entry anchors ARE the complete answer — trace no chains, one anchor per concept; the SOLE exception: a query that EXPLICITLY asks flow/default-resolution whose turn 1 yielded only an entry anchor (not the resolved value) may take ONE turn-2 hop to the resolving site, then stop. You locate WHERE, never WHY. Scope is ALWAYS the session working directory: omit path (project cwd default) or pass only a path seen in an earlier result; an unverified path/name fragment rides the SAME turn-1 find query[] batch (a find-only turn is a defect) and scopes grep/glob only through the exact path find returns; inventing a directory (/workspace/..., another repo's layout) is a defect — on zero hits change TOKENS, never guess paths. HARD max 3 tool turns; counter line (turn 1/3, turn 2/3, turn 3/3) on every tool message; expected shape is turn 1 -> answer, turns 2-3 are miss-recovery only (previous turn had ZERO matching lines), with changed tokens; after turn 3/3 you MUST answer best-so-far. Each turn = ONE maximal batch: a single grep whose pattern[] packs ALL token variants PLUS code_graph/find/glob in the SAME message; a single-tool turn is a wasted turn. Before emitting EXPLORATION_FAILED re-scan ALL earlier results: any line matching a specific query token -> answer with that anchor (? if weak) — a weak anchor beats a false miss; EXPLORATION_FAILED only when all 3 turns found zero token-matching lines. Output only anchor lines formatted as path:line — symbol/name — short reason, max 3 lines, or EXPLORATION_FAILED. For a CODE-location answer every line MUST carry :line (an explicit line number) — a bare filename with no :line is a DEFECT; with no line-anchored code evidence, return EXPLORATION_FAILED rather than a vague file-only or prose answer. EXCEPTION — file/dir-LOCATION queries (where does X store its config/logs/data on disk, which directory or file holds Y): an exact VERIFIED path (the file or directory itself, no :line) IS the valid answer — do not force a line number and do not FAIL. No preamble, bullets, numbering, headings, summary, code quotes, analysis, verdicts, ratings, or recommendations.`;
 }
 
 export function normalizeExploreQueries(rawQuery) {

package/src/tui/App.jsx

@@ -1494,7 +1494,8 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false })
       const n = Number(value || 0);
       const d = Number(total || 0);
       if (!d) return 'N/A';
-      return `${((n / d) * 100).toFixed(n > 0 && n < d / 100 ? 1 : 0)}%`;
+      const p = Math.max(0, Math.min(100, (n / d) * 100));
+      return `${p > 0 && p < 1 ? p.toFixed(1) : Math.floor(p)}%`;
     };
     const fmt = (value) => {
       const n = Number(value || 0);
@@ -2153,12 +2154,12 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false })
       }
     }
     if (!commandText) return false;
-    if (state.commandBusy) {
-      store.pushNotice('wait for the current command to finish', 'warn');
-      return false;
-    }
 
     if (commandText.startsWith('/')) {
+      if (state.commandBusy) {
+        store.pushNotice('wait for the current command to finish', 'warn');
+        return false;
+      }
       const [cmd, ...rest] = commandText.slice(1).split(/\s+/);
       const accepted = runSlashCommand(cmd, rest.join(' ').trim());
       if (accepted !== false) clearPastedImagesSnapshot();

package/src/tui/app/transcript-window.mjs

@@ -537,6 +537,7 @@ function computeTranscriptItemVariantKey(item) {
     const count = Number(item.count ?? 0);
     const completed = item.completedCount === undefined ? 'u' : Number(item.completedCount);
     const errors = item.errorCount === undefined ? 'u' : Number(item.errorCount);
+    const callErrors = item.callErrorCount === undefined ? 'u' : Number(item.callErrorCount);
     const isError = item.isError ? 1 : 0;
     const normalizedName = String(normalizeToolName(item.name) || '').toLowerCase();
     const aggregate = item.aggregate ? 1 : 0;
@@ -547,7 +548,7 @@ function computeTranscriptItemVariantKey(item) {
     const bgPrompt = textShapeFingerprint(bgArgs.prompt);
     const bgMessage = textShapeFingerprint(bgArgs.message);
     const bgError = textShapeFingerprint(bgArgs.error);
-    return `x${expanded}:n${normalizedName}:g${aggregate}:r${resultShape}:R${rawShape}:c${count}:d${completed}:e${errors}:E${isError}:bt${bgType}:bs${bgStatus}:bk${bgTaskId}:bp${bgPrompt}:bm${bgMessage}:be${bgError}`;
+    return `x${expanded}:n${normalizedName}:g${aggregate}:r${resultShape}:R${rawShape}:c${count}:d${completed}:e${errors}:ce${callErrors}:E${isError}:bt${bgType}:bs${bgStatus}:bk${bgTaskId}:bp${bgPrompt}:bm${bgMessage}:be${bgError}`;
   }
   return `x${expanded}:s${textShapeFingerprint(item.text ?? item.result ?? '')}`;
 }
@@ -568,13 +569,43 @@ export const transcriptMeasuredRowsCache = new WeakMap();
 // (its final settled height is then captured by the normal WeakMap path).
 export const streamingMeasuredRowsById = new Map();
 
+// High-water clamp for the STREAMING row ESTIMATE, keyed by stream item id.
+// measureStreamingMarkdownRenderedRows (measure-rendered-rows.mjs) adds a +1
+// gap row only while childCount===2 (stablePrefix box + unstableSuffix box).
+// As the stable/unstable split moves per token — and when the suffix is
+// momentarily whitespace-only, stablePrefix empties — childCount flips 1↔2
+// frame-to-frame, so the estimate oscillates ±1. Streaming text only ever
+// GROWS, so any per-frame DECREASE is spurious. Hold the max estimate seen this
+// streaming run so streamingEstimateRows is NON-DECREASING, killing the -1 dip
+// that shifts the transcript when a newline settles. Entry stores columns/
+// toolExpanded so a real layout-basis change resets the water line (row count
+// legitimately changes with width). Lifecycle mirrors streamingMeasuredRowsById
+// exactly: pruned by pruneStreamingMeasuredRowsById and cleared at the same
+// settle / invalidate delete sites in estimateTranscriptItemRowsCached.
+const streamingEstimateHighWaterById = new Map();
+
+/** True when either streaming id-keyed store holds entries, so the mount-prune
+ * call site fires even when only the estimate high-water map is populated (an
+ * item that never got a Yoga measurement but reached an estimate high-water,
+ * then was bulk-replaced, must still be pruned). */
+export function hasStreamingRowStateToPrune() {
+  return streamingMeasuredRowsById.size > 0 || streamingEstimateHighWaterById.size > 0;
+}
+
 /** Drop streamingMeasuredRowsById entries for ids no longer mounted, so the
  * store does not grow unbounded over a long session (mirrors the id→item /
  * id→callback map pruning already done for the mounted set). */
 export function pruneStreamingMeasuredRowsById(liveIds) {
-  if (!liveIds || streamingMeasuredRowsById.size === 0) return;
-  for (const id of streamingMeasuredRowsById.keys()) {
-    if (!liveIds.has(id)) streamingMeasuredRowsById.delete(id);
+  if (!liveIds) return;
+  if (streamingMeasuredRowsById.size > 0) {
+    for (const id of streamingMeasuredRowsById.keys()) {
+      if (!liveIds.has(id)) streamingMeasuredRowsById.delete(id);
+    }
+  }
+  if (streamingEstimateHighWaterById.size > 0) {
+    for (const id of streamingEstimateHighWaterById.keys()) {
+      if (!liveIds.has(id)) streamingEstimateHighWaterById.delete(id);
+    }
   }
 }
 
@@ -627,7 +658,21 @@ export function streamingEstimateRows(item, columns, toolOutputExpanded) {
   const trimmedText = assistantTextForStreamingRowEstimate(item.text);
   const estimateItem = trimmedText === item.text ? item : { ...item, text: trimmedText };
   const raw = Math.max(1, Math.ceil(estimateTranscriptItemRows(estimateItem, columns, toolOutputExpanded)));
-  return Math.ceil(raw / STREAMING_ROW_QUANTUM) * STREAMING_ROW_QUANTUM;
+  const quantized = Math.ceil(raw / STREAMING_ROW_QUANTUM) * STREAMING_ROW_QUANTUM;
+  // High-water clamp: streaming text only grows, so never report fewer rows than
+  // this id already reached this run — absorbs the childCount 1↔2 gap flip that
+  // otherwise dips the estimate ±1 frame-to-frame. A columns/expanded change
+  // resets the water line (new width → legitimately new row count).
+  const id = item?.id;
+  if (id == null) return quantized;
+  const toolExpanded = toolOutputExpanded ? 1 : 0;
+  const prev = streamingEstimateHighWaterById.get(id);
+  if (!prev || prev.columns !== columns || prev.toolExpanded !== toolExpanded) {
+    streamingEstimateHighWaterById.set(id, { rows: quantized, columns, toolExpanded });
+    return quantized;
+  }
+  if (quantized > prev.rows) prev.rows = quantized;
+  return prev.rows;
 }
 
 // ── Same-frame streaming-tail growth compensation (scrolled-up only) ────────
@@ -705,15 +750,20 @@ export function estimateTranscriptItemRowsCached(item, columns, toolOutputExpand
       // estimate frame.
       return idEntry.rows;
     }
-    if (idEntry) streamingMeasuredRowsById.delete(item.id);
+    if (idEntry) {
+      streamingMeasuredRowsById.delete(item.id);
+      streamingEstimateHighWaterById.delete(item.id);
+    }
     // No confirmed measurement yet for this id (item just started streaming):
     // nothing to defer against, so the first frame falls back to the estimate.
     return streamingEstimateRows(item, columns, toolOutputExpanded);
   }
-  if (item.kind === 'assistant' && streamingMeasuredRowsById.has(item.id)) {
-    // Item settled (no longer streaming): the id-keyed floor is no longer
-    // relevant, the normal WeakMap-measured path now owns its height.
-    streamingMeasuredRowsById.delete(item.id);
+  if (item.kind === 'assistant') {
+    // Item settled (no longer streaming): the id-keyed floor and the estimate
+    // high-water are no longer relevant — the normal WeakMap-measured path now
+    // owns its height. Clear both so a later id reuse / this run cannot leak.
+    if (streamingMeasuredRowsById.has(item.id)) streamingMeasuredRowsById.delete(item.id);
+    if (streamingEstimateHighWaterById.has(item.id)) streamingEstimateHighWaterById.delete(item.id);
   }
   const variantKey = transcriptItemVariantKey(item);
   const toolExpanded = toolOutputExpanded ? 1 : 0;

package/src/tui/app/use-transcript-window.mjs

@@ -15,6 +15,7 @@ import {
   transcriptMeasuredRowsCache,
   streamingMeasuredRowsById,
   pruneStreamingMeasuredRowsById,
+  hasStreamingRowStateToPrune,
   transcriptItemVariantKey,
   buildTranscriptRowIndexIncremental,
   transcriptStructureSignature,
@@ -632,7 +633,7 @@ export function useTranscriptWindow({
         if (!els.has(key)) refCache.delete(key);
       }
     }
-    if (streamingMeasuredRowsById.size > 0) {
+    if (hasStreamingRowStateToPrune()) {
       pruneStreamingMeasuredRowsById(new Set(liveItems.keys()));
     }
   });

package/src/tui/components/ContextPanel.jsx

@@ -48,7 +48,10 @@ function percent(value, total) {
 function percentLabel(value, total) {
   const pct = percent(value, total);
   if (pct === null) return 'N/A';
-  return `${pct > 0 && pct < 1 ? pct.toFixed(1) : Math.round(pct)}%`;
+  // Match the footer/statusline display: sub-1% keeps one decimal, otherwise
+  // show the floored percentage so /context and the statusline do not disagree
+  // by 1% around half-percent boundaries.
+  return `${pct > 0 && pct < 1 ? pct.toFixed(1) : Math.floor(pct)}%`;
 }
 
 function usageColor(pct) {

package/src/tui/components/ToolExecution.jsx

@@ -73,7 +73,6 @@ export function displayToolName(name, args) {
 }
 
 const TOOL_BLINK_MS = 500;
-const TOOL_BLINK_LIMIT_MS = 3000;
 const TOOL_PENDING_SHOW_DELAY_MS = 1000;
 // One shared-tick cadence covers both the 500ms blink and per-second elapsed;
 // finer than either boundary so both stay crisp off a single timer.
@@ -87,7 +86,7 @@ function statusCopy(name, label, count, doneCount, pending, isError, args = {})
   // dropping the pad just normalizes the spacing.
   return formatToolActionHeader(name, args, { pending, count });
 }
-export function ToolExecution({ name, args, result, rawResult, isError, errorCount, expanded, columns = 80, attached = false, count = 1, completedCount = 0, startedAt = 0, completedAt = 0, aggregate = false, categories = {}, doneCategories = null, headerFinalized = true, deferredDisplayReady = false }) {
+export function ToolExecution({ name, args, result, rawResult, isError, errorCount, callErrorCount, expanded, columns = 80, attached = false, count = 1, completedCount = 0, startedAt = 0, completedAt = 0, aggregate = false, categories = {}, doneCategories = null, headerFinalized = true, deferredDisplayReady = false }) {
   const rowWidth = Math.max(1, Number(columns || 80));
   const groupCount = Math.max(1, Number(count || 1));
   const doneCount = Math.max(0, Math.min(groupCount, Number(completedCount || (result == null ? 0 : groupCount))));
@@ -116,13 +115,11 @@ export function ToolExecution({ name, args, result, rawResult, isError, errorCou
   // land — no empty band.
   const hasVisibleProgress = doneCount > 0 || Boolean(String(rt || '').trim());
   const pendingDisplayReady = !pending || !startedAtMs || pendingDelayElapsed || pendingAgeMs >= TOOL_PENDING_SHOW_DELAY_MS || hasVisibleProgress || deferredDisplayReady;
-  // Derived blink (was two per-card setIntervals + a setTimeout): the dot blinks
-  // at TOOL_BLINK_MS while a display-ready pending card is fresh, then goes solid
-  // once TOOL_BLINK_LIMIT_MS elapses. Phase comes from Date.now() so the cadence
-  // is identical to the old interval without owning a timer.
+  // Derived blink (was two per-card setIntervals + a setTimeout): while pending,
+  // the dot keeps blinking until the tool resolves. Phase comes from Date.now()
+  // so the cadence is identical to the old interval without owning a timer.
   const blinkActive = pending && pendingDisplayReady;
-  const blinkExpired = blinkActive && startedAtMs > 0 && (nowMs - startedAtMs) >= TOOL_BLINK_LIMIT_MS;
-  const blinkOn = !blinkActive || blinkExpired
+  const blinkOn = !blinkActive
     ? true
     : Math.floor(nowMs / TOOL_BLINK_MS) % 2 === 0;
   // Keep the action verb in its active form until the engine explicitly seals
@@ -135,6 +132,12 @@ export function ToolExecution({ name, args, result, rawResult, isError, errorCou
   const elapsedMs = startedAtMs ? Math.max(0, (pending ? nowMs : (completedAtMs || nowMs)) - startedAtMs) : 0;
   const elapsed = elapsedMs >= 1000 ? formatElapsed(elapsedMs) : '';
   const failedCount = clampFailureCount(errorCount, groupCount, isError);
+  // Real tool-call failures only (backend isError / error toolKind). Drives the
+  // ● dot color; command/result failures (shell exit, failed status) are counted
+  // in `failedCount`/L2 detail but never in `callFailedCount`, so they never
+  // paint the dot red. Fall back to 0 (never `isError`) when the engine did not
+  // supply a call-error count so a result failure can't leak into the dot.
+  const callFailedCount = clampFailureCount(callErrorCount, groupCount, false);
   const displayGroupCount = groupCount;
   const displayCategories = normalizeCountMap(categories || {});
   // In the DONE state, count only successful calls: error-terminated calls are
@@ -209,8 +212,8 @@ export function ToolExecution({ name, args, result, rawResult, isError, errorCou
     const aggregateTerminalStatus = pending
       ? 'running'
       : (resultTerminalStatus(rt) || (isError || failedCount > 0 ? 'failed' : 'completed'));
-    const dotColor = toolStatusColor({ pending, groupCount, failedCount, terminalStatus: aggregateTerminalStatus });
-    const dotText = pending && !blinkExpired && !blinkOn ? ' ' : TURN_MARKER;
+    const dotColor = toolStatusColor({ pending, groupCount, callFailedCount, terminalStatus: aggregateTerminalStatus });
+    const dotText = pending && !blinkOn ? ' ' : TURN_MARKER;
     const gutter = 2;
     const showHeaderExpandHint = hasRawResult;
     const hintLabel = `ctrl+o ${expanded ? 'collapse' : 'expand'}`;
@@ -423,7 +426,7 @@ export function ToolExecution({ name, args, result, rawResult, isError, errorCou
     const keepAgentDetail = (isError || agentFailureText) && !(agentHeaderFailure && !agentSurfaceBrief);
     visibleDetailLines = keepAgentDetail ? [agentDetailLine] : [];
   }
-  const finalStatusColor = toolStatusColor({ pending, groupCount, failedCount, terminalStatus });
+  const finalStatusColor = toolStatusColor({ pending, groupCount, callFailedCount, terminalStatus });
   const dotColor = finalStatusColor;
   // Agent surface cards use directional markers: `←` for requests going OUT
   // (spawn/send/etc.) and `→` for the response coming back IN. Background
@@ -441,7 +444,7 @@ export function ToolExecution({ name, args, result, rawResult, isError, errorCou
   // `●` turn marker is a true 1-cell glyph and keeps the padding-only gutter.
   const isDirectionalMarker = isAgentResponse || isAgentSurfaceCard;
   const markerText = isDirectionalMarker ? `${markerGlyph} ` : markerGlyph;
-  const dotText = pending && !blinkExpired && !blinkOn ? ' ' : markerText;
+  const dotText = pending && !blinkOn ? ' ' : markerText;
   let labelText;
   if (isAgentResponse) labelText = agentResponseTitle(parsedArgs);
   else if (isBackgroundResponse) labelText = backgroundTaskResultTitle(normalizedName, backgroundMeta || parsedArgs);

package/src/tui/components/TranscriptItem.jsx

@@ -77,7 +77,7 @@ export const Item = React.memo(function Item({ item, prevKind, columns, toolOutp
         node = <ToolHookDenialCard item={item} columns={columns} />;
         break;
       }
-      node = <ToolExecution name={item.name} args={item.args} result={item.result} rawResult={item.rawResult} isError={item.isError} errorCount={item.errorCount} expanded={toolOutputExpanded || item.expanded} columns={columns} attached={false} count={item.count} completedCount={item.completedCount} startedAt={item.startedAt} completedAt={item.completedAt} aggregate={item.aggregate} categories={item.categories} doneCategories={item.doneCategories} headerFinalized={item.headerFinalized} deferredDisplayReady={item.deferredDisplayReady} themeEpoch={themeEpoch} />;
+      node = <ToolExecution name={item.name} args={item.args} result={item.result} rawResult={item.rawResult} isError={item.isError} errorCount={item.errorCount} callErrorCount={item.callErrorCount} expanded={toolOutputExpanded || item.expanded} columns={columns} attached={false} count={item.count} completedCount={item.completedCount} startedAt={item.startedAt} completedAt={item.completedAt} aggregate={item.aggregate} categories={item.categories} doneCategories={item.doneCategories} headerFinalized={item.headerFinalized} deferredDisplayReady={item.deferredDisplayReady} />;
       break;
     }
     case 'notice':

package/src/tui/components/tool-execution/surface-detail.mjs

@@ -390,16 +390,16 @@ export function clampFailureCount(errorCount, groupCount, isError) {
 //   partial failure  -> mixdogOrange || warning (some, not all, of the group failed)
 //   all failed       -> theme.error
 //   cancelled        -> theme.warning
-// Note: callers resolve terminalStatus to 'failed' whenever failedCount > 0
-// (they cannot tell partial from total failure), so a 'failed' status must
-// still fall through to the failedCount check below rather than short-circuit
-// to error — otherwise a mixed-success batch (e.g. 1 of 3 failed) renders as
-// full-failure red instead of partial orange.
-export function toolStatusColor({ pending, groupCount, failedCount, terminalStatus = '' }) {
+// The RED/orange failure color is driven ONLY by real tool-call errors
+// (`callFailedCount` — backend isError / error toolKind), NOT by command/result
+// failures like a shell non-zero exit or a `[status: failed]` result. Those
+// keep the card's L2 detail showing "Failed" but leave the dot on the success
+// color. `terminalStatus` is still consulted so a cancelled card stays warning.
+export function toolStatusColor({ pending, groupCount, callFailedCount = 0, terminalStatus = '' }) {
   if (pending) return theme.text;
   const status = normalizeTerminalStatus(terminalStatus);
   if (status === 'cancelled') return theme.warning;
-  if (failedCount <= 0) return status === 'failed' ? theme.error : theme.success;
-  if (groupCount > 1 && failedCount < groupCount) return theme.mixdogOrange || theme.warning;
+  if (callFailedCount <= 0) return theme.success;
+  if (groupCount > 1 && callFailedCount < groupCount) return theme.mixdogOrange || theme.warning;
   return theme.error;
 }