mixdog 0.9.45 → 0.9.47

package/scripts/tool-smoke.mjs

@@ -739,7 +739,10 @@ const compactedGuardCases = [
 ];
 for (const [label, patch] of compactedGuardCases) {
   const out = await executePatchTool('apply_patch', { base_path: root, dry_run: true, fuzzy: false, patch }, root);
-  if (!/^Error[\s:[]/.test(String(out)) || !/compacted-history placeholder/i.test(String(out))) {
+  if (!/^Error[\s:[]/.test(String(out))
+      || !/compacted-history placeholder/i.test(String(out))
+      || !/re-read the current target file contents now/i.test(String(out))
+      || !/fresh full patch/i.test(String(out))) {
     throw new Error(`apply_patch must reject compacted placeholder (${label}):\n${out}`);
   }
 }
@@ -1366,7 +1369,7 @@ setInternalToolsProvider({
     if (!/Read-only retrieval role/i.test(visible) || /# environment/i.test(visible) || /git operations deferred to Lead/i.test(visible)) {
       throw new Error(`explorer hidden retrieval context should stay slim: ${visible.slice(0, 1200)}`);
     }
-    if (!/# Role: explorer/i.test(systemVisible) || /# Role: explorer/i.test(userReminderVisible) || !/deliver WHERE/i.test(systemVisible)) {
+    if (!/# Role: explorer/i.test(systemVisible) || /# Role: explorer/i.test(userReminderVisible) || !/only WHERE/i.test(systemVisible)) {
       throw new Error(`explorer role md must ride BP2 system, not BP3 user reminder: system=${systemVisible.slice(0, 600)} user=${userReminderVisible.slice(0, 600)}`);
     }
     // System layers (BP1 tool policy + BP2 role md) are shared/frozen and sized
@@ -1728,10 +1731,10 @@ for (const requiredGrammarLine of [
 }
 const readPathSchema = BUILTIN_TOOLS.find((tool) => tool.name === 'read')?.inputSchema?.properties?.path || {};
 const readPathDescription = readPathSchema.description || '';
-if (!/Verified file path/i.test(readPathDescription) || !/\{path,offset,limit\}\[\]/i.test(readPathDescription) || !/Pass arrays directly/i.test(readPathDescription) || !/legacy recovery only/i.test(readPathDescription)) {
+if (!/\{path,offset,limit\}\[\]/i.test(readPathDescription) || !/real arrays/i.test(readPathDescription)) {
   throw new Error('read schema must keep directory-vs-file guidance');
 }
-if (!/Not for directory listing/i.test((BUILTIN_TOOLS.find((tool) => tool.name === 'read')?.description) || '')) {
+if (!/Not for director/i.test((BUILTIN_TOOLS.find((tool) => tool.name === 'read')?.description) || '')) {
   throw new Error('read description must keep directory-vs-file guidance');
 }
 const readTool = BUILTIN_TOOLS.find((tool) => tool.name === 'read');
@@ -1742,13 +1745,13 @@ const readArrayItemAnyOf = readArraySchema?.items?.anyOf || [];
 if (!readArrayItemAnyOf.some((entry) => entry?.type === 'object' && entry?.properties?.offset && entry?.properties?.limit)) {
   throw new Error('read schema must expose array-of-region objects for batched spans');
 }
-if (/line\+context/i.test(readDescription) || !/verified file path/i.test(readDescription) || !/guessed path.*find first/i.test(readDescription) || !/Batch paths\/regions as real arrays/i.test(readDescription)) {
+if (/line\+context/i.test(readDescription) || !/Read file contents/i.test(readDescription) || !/\{path,offset,limit\}\[\]/i.test(readDescription)) {
   throw new Error('read description must expose offset/limit as the single window form');
 }
 if (readProps.line || readProps.context) {
   throw new Error('read schema must not expose legacy line/context window fields');
 }
-if (readProps.offset?.minimum !== 0 || !/Numeric lines to skip/i.test(readProps.offset?.description || '') || !/offset:N/i.test(readProps.offset?.description || '') || !/Numeric max lines/i.test(readProps.limit?.description || '')) {
+if (readProps.offset?.minimum !== 0 || !/Lines to skip/i.test(readProps.offset?.description || '') || !/Max lines/i.test(readProps.limit?.description || '')) {
   throw new Error('read offset schema must describe Mixdog paging cursor semantics');
 }
 if (/line\/context/i.test(JSON.stringify(readTool?.inputSchema || {}))) {
@@ -1839,21 +1842,18 @@ if (codeGraphSymbolSearchErr) {
 // symbol/definition/caller lookups AWAY from repeated grep (the grep_retry +
 // find_symbol_noscope anti-patterns). It is allowed to be verbose enough to
 // enumerate modes, but must not drift into web-search territory.
-if (!/code structure\/flow/i.test(codeGraphDescription) || !/symbols\/references\/calls\/deps/i.test(codeGraphDescription)) {
+if (!/Repo code structure/i.test(codeGraphDescription) || !/find_symbol\/symbol_search\/search\/references\/callers\/callees/i.test(codeGraphDescription)) {
   throw new Error('code_graph description must stay structure-oriented and name its symbol modes');
 }
-if (!/files\[\] must be verified paths/i.test(codeGraphDescription) || !/Batch symbols\[\]\/files\[\]/i.test(codeGraphDescription)) {
+if (!/take files\[\]/i.test(codeGraphDescription) || !/Batch targets per mode/i.test(codeGraphDescription)) {
   throw new Error('code_graph description must route unknown file paths through locators first');
 }
-if (!/repo-local/i.test(codeGraphDescription) || !/NOT web search|not web/i.test(codeGraphDescription)) {
-  throw new Error('code_graph description must mark itself repo-local (not web search)');
-}
-if (!/repo-local|not web/i.test(codeGraphProps.mode?.description || '') || !/Verified source file/i.test(codeGraphProps.files?.description || '')) {
+if (!/files\[\]/i.test(codeGraphProps.mode?.description || '') || !/Source file path/i.test(codeGraphProps.files?.description || '')) {
   throw new Error('code_graph schema must keep compact, repo-local field descriptions');
 }
 const recallTool = MEMORY_TOOL_DEFS.find((tool) => tool.name === 'recall');
 const recallProps = recallTool?.inputSchema?.properties || {};
-if (!/Call when a task ties to prior work/i.test(recallTool?.description || '') || !recallProps.id?.anyOf || !/Do not invent ids/i.test(recallProps.id?.description || '')) {
+if (!/prior-work context/i.test(recallTool?.description || '') || !recallProps.id?.anyOf || !/Do not invent ids/i.test(recallProps.id?.description || '')) {
   throw new Error('recall schema must preserve scoped prior-context guidance and id lookup shape');
 }
 if (!/array for independent fan-out/i.test(recallProps.query?.description || '') || !/Project pool selector/i.test(recallProps.projectScope?.description || '')) {
@@ -2155,13 +2155,13 @@ const grepPathDescription = grepTool?.inputSchema?.properties?.path?.description
 const grepGlobDescription = grepTool?.inputSchema?.properties?.glob?.description || '';
 const grepOutputModeDescription = grepTool?.inputSchema?.properties?.output_mode?.description || '';
 const grepHeadLimitDescription = grepTool?.inputSchema?.properties?.head_limit?.description || '';
-if (!/Array = variants in one call/i.test(grepPatternDescription) || !/Verified file\/dir/i.test(grepPathDescription)) {
+if (!/pattern\[\] batches variants/i.test(grepPatternDescription) || !/File\/dir scope/i.test(grepPathDescription)) {
   throw new Error('grep schema must keep compact pattern/path guidance');
 }
-if (!/verified scope/i.test(grepTool?.description || '') || !/guessed path fragment.*find first/i.test(grepTool?.description || '')) {
-  throw new Error('grep description must require verified scopes and locator-first unknown paths');
+if (!/content search/i.test(grepTool?.description || '')) {
+  throw new Error('grep description must state its content-search contract');
 }
-if (!/Glob filter/i.test(grepGlobDescription) || !/no guessed src\/\*\*/i.test(grepGlobDescription)) {
+if (!/Glob filter/i.test(grepGlobDescription)) {
   throw new Error('grep glob schema must describe scope narrowing');
 }
 if (!/files_with_matches\/count/i.test(grepOutputModeDescription) || !/content_with_context/i.test(grepOutputModeDescription)) {
@@ -2176,16 +2176,16 @@ if (grepTool?.inputSchema?.properties?.type) {
 const globTool = BUILTIN_TOOLS.find((tool) => tool.name === 'glob');
 const findTool = BUILTIN_TOOLS.find((tool) => tool.name === 'find');
 const listTool = BUILTIN_TOOLS.find((tool) => tool.name === 'list');
-if (!/exact glob from verified roots/i.test(globTool?.description || '')) {
+if (!/exact glob patterns/i.test(globTool?.description || '')) {
   throw new Error('glob description must route exact-pattern unknown paths before read/grep/list');
 }
-if (!/Partial path\/name lookup/i.test(findTool?.description || '') || !/verify roots before grep\/glob/i.test(findTool?.description || '')) {
+if (!/unknown partial paths\/names/i.test(findTool?.description || '') || !/verifies paths for grep\/glob/i.test(findTool?.description || '')) {
   throw new Error('find description must advertise unverified path/name lookup and verified outputs');
 }
-if (!/List verified directories/i.test(listTool?.description || '') || !/Guessed dir.*find first/i.test(listTool?.description || '') || !/Verified directory/i.test(listTool?.inputSchema?.properties?.path?.description || '')) {
+if (!/List directory entries/i.test(listTool?.description || '') || !/path\[\]/i.test(listTool?.inputSchema?.properties?.path?.description || '')) {
   throw new Error('list description must require verified directories and locator-first unknown dirs');
 }
-if (!/Repo-local/i.test(codeGraphProps.mode?.description || '') || !/one call/i.test(codeGraphProps.symbols?.description || '')) {
+if (!/symbol modes use symbols\[\]/i.test(codeGraphProps.mode?.description || '') || !/symbols \(file outline\) use files\[\]/i.test(codeGraphProps.mode?.description || '') || !/one symbols\[\] call/i.test(codeGraphProps.symbols?.description || '')) {
   throw new Error('code_graph schema fields must stay compact and repo-local');
 }
 

package/scripts/tool-tui-presentation-test.mjs

@@ -20,6 +20,11 @@ import {
   appendAgentResponseTail,
   formatAgentResponseRaw,
 } from '../src/tui/engine/agent-response-tail.mjs';
+import {
+  agentArgsWithResultMetadata,
+  parseAgentJob,
+} from '../src/tui/engine/agent-envelope.mjs';
+import { agentActionTitle } from '../src/tui/components/tool-execution/surface-detail.mjs';
 
 test('tool action copy keeps Add/Delete patch verbs and human read offsets', () => {
   assert.equal(
@@ -42,6 +47,69 @@ test('Agent aggregation is batch-scoped and keeps category action wording', () =
   );
 });
 
+test('agent spawn cards retain resolved model metadata from split result envelopes', () => {
+  const parsed = parseAgentJob([
+    'agent task: task_worker_1',
+    'status: running',
+    'type: spawn',
+    'target: worker sess_worker_1',
+    'agent: worker',
+    'provider: openai-oauth',
+    'model: gpt-5.6-terra',
+    'preset: agent-worker',
+    'effort: high',
+  ].join('\n'));
+  const args = agentArgsWithResultMetadata({ type: 'spawn', agent: 'worker' }, parsed);
+
+  assert.equal(args.tag, 'worker');
+  assert.equal(args.provider, 'openai-oauth');
+  assert.equal(args.model, 'gpt-5.6-terra');
+  assert.equal(args.effort, 'high');
+  assert.equal(agentActionTitle(args), 'Spawn Worker (GPT-5.6-Terra, worker)');
+});
+
+test('agent model enrichment preserves explicit args and combined envelopes', () => {
+  const combined = parseAgentJob([
+    'agent task: task_worker_2',
+    'type: spawn',
+    'model: openai-oauth/gpt-5.6-terra',
+  ].join('\n'));
+  assert.equal(combined.provider, 'openai-oauth');
+  assert.equal(combined.model, 'gpt-5.6-terra');
+
+  const split = parseAgentJob([
+    'agent task: task_worker_3',
+    'provider: openai-oauth',
+    'model: gpt-5.6-terra',
+  ].join('\n'));
+  const explicit = agentArgsWithResultMetadata({
+    provider: 'anthropic',
+    model: 'claude-opus-4-6',
+  }, split);
+  assert.equal(explicit.provider, 'anthropic');
+  assert.equal(explicit.model, 'claude-opus-4-6');
+});
+
+test('non-agent task diagnostics do not enrich model args', () => {
+  const shellDiagnostics = parseAgentJob([
+    'task_id: shell_task_1',
+    'provider: openai-oauth',
+    'model: gpt-5.6-terra',
+  ].join('\n'));
+  const args = agentArgsWithResultMetadata({ type: 'shell' }, shellDiagnostics);
+
+  assert.equal(args.provider, undefined);
+  assert.equal(args.model, undefined);
+
+  const shellCombinedDiagnostics = parseAgentJob([
+    'task_id: shell_task_2',
+    'model: openai-oauth/gpt-5.6-terra',
+  ].join('\n'));
+  const combinedArgs = agentArgsWithResultMetadata({ type: 'shell' }, shellCombinedDiagnostics);
+  assert.equal(combinedArgs.provider, undefined);
+  assert.equal(combinedArgs.model, undefined);
+});
+
 test('terminal result statuses stay separate from tool-call failure accounting', () => {
   assert.equal(normalizeToolTerminalStatus('denied'), 'denied');
   assert.equal(toolResultTerminalStatus('[status: cancelled]\n'), 'cancelled');

package/scripts/tui-transcript-jitter-harness-entry.jsx

@@ -44,23 +44,32 @@ let commit = 0;
 const identity = (value) => value;
 const noop = () => {};
 
-function Harness({ text, step }) {
-  const [scrollOffset, setScrollOffset] = React.useState(INITIAL_SCROLL);
+function Harness({
+  text,
+  step,
+  initialScroll = INITIAL_SCROLL,
+  streamId = STREAM_ID,
+  releasedSelection = null,
+  onPaint = noop,
+  onFrame = noop,
+  recordFrame = true,
+}) {
+  const [scrollOffset, setScrollOffset] = React.useState(initialScroll);
   const [measuredRowsVersion, setMeasuredRowsVersion] = React.useState(0);
   const transcriptAnchorRef = React.useRef(null);
   const transcriptAnchorDirtyRef = React.useRef(true);
-  const scrollTargetRef = React.useRef(INITIAL_SCROLL);
-  const scrollPositionRef = React.useRef(INITIAL_SCROLL);
+  const scrollTargetRef = React.useRef(initialScroll);
+  const scrollPositionRef = React.useRef(initialScroll);
   const maxScrollRowsRef = React.useRef(0);
   const transcriptGeomRef = React.useRef({});
   const followingRef = React.useRef(false);
-  const dragRef = React.useRef({ active: false, rect: null });
+  const dragRef = React.useRef({ active: false, rect: releasedSelection });
   const transcriptViewportRef = React.useRef({ top: 0 });
   const selectionLayoutRef = React.useRef(null);
   const contentRef = React.useRef(null);
   const tailRef = React.useRef(null);
   const streamingTail = React.useMemo(() => ({
-    id: STREAM_ID,
+    id: streamId,
     kind: 'assistant',
     text,
     streaming: true,
@@ -100,7 +109,7 @@ function Harness({ text, step }) {
     transcriptViewportRef,
     selectionLayoutRef,
     withSelectionClip: identity,
-    paintSelectionRect: noop,
+    paintSelectionRect: onPaint,
     stopSmoothScroll: noop,
     measuredRowsVersion,
     setMeasuredRowsVersion,
@@ -121,7 +130,7 @@ function Harness({ text, step }) {
     const renderScrollOffset = transcriptWindow.effectiveScrollOffset;
     const visibleTopIndexed = transcriptWindow.totalRows - renderScrollOffset - VIEW_ROWS;
     const visibleTopPhysical = physicalRows - renderScrollOffset - VIEW_ROWS;
-    frames.push({
+    const frame = {
       commit: ++commit,
       step,
       char: text.at(-1) === '\n' ? '\\n' : (text.at(-1) || ''),
@@ -145,7 +154,9 @@ function Harness({ text, step }) {
       scrollTarget: scrollTargetRef.current,
       following: followingRef.current,
       anchor: transcriptAnchorRef.current?.id || '-',
-    });
+    };
+    if (recordFrame) frames.push(frame);
+    onFrame(frame);
   }, [step, text, measuredRowsVersion, transcriptWindow.totalRows, transcriptWindow.effectiveScrollOffset,
     transcriptAnchorRef, transcriptGeomRef]);
 
@@ -159,7 +170,7 @@ function Harness({ text, step }) {
         marginBottom={-transcriptWindow.effectiveScrollOffset}
       >
         {renderedTranscriptItems.map((item, index, all) => {
-          const hookRef = item.id === STREAM_ID ? combinedTailRef : transcriptMeasureRef(item);
+          const hookRef = item.id === streamId ? combinedTailRef : transcriptMeasureRef(item);
           return (
             <Box key={item.id} ref={hookRef} flexDirection="column" flexShrink={0}>
               <Item
@@ -295,6 +306,76 @@ if (dips.length > 0) {
 if (suppressValues.size !== 1 || !suppressValues.has(true)) {
   throw new Error('repro unexpectedly toggled suppressMeasuredRowHeights');
 }
+
+const SELECTION_STREAM_ID = 'released-selection-tail';
+const releasedSelection = { mode: 'linear', x1: 0, y1: 3, x2: 4, y2: 3 };
+const selectionHarvests = [];
+const selectionFrames = [];
+streamingMeasuredRowsById.delete(SELECTION_STREAM_ID);
+const selectionInstance = render(
+  <Harness
+    text="seed"
+    step={0}
+    initialScroll={1}
+    streamId={SELECTION_STREAM_ID}
+    releasedSelection={releasedSelection}
+    recordFrame={false}
+    onPaint={(rect, options) => {
+      if (rect && options?.rememberText === false) selectionHarvests.push({ y1: rect.y1, y2: rect.y2 });
+    }}
+    onFrame={(frame) => selectionFrames.push(frame)}
+  />,
+  { stdout: fakeTty(COLUMNS, VIEW_ROWS), stderr: fakeTty(COLUMNS, VIEW_ROWS), stdin: fakeTty(COLUMNS, VIEW_ROWS), interactive: true, patchConsole: false, exitOnCtrlC: false, maxFps: 1000 },
+);
+await settle(selectionInstance);
+const harvestsBeforeGrowth = selectionHarvests.length;
+const framesBeforeGrowth = selectionFrames.length;
+selectionInstance.rerender(
+  <Harness
+    text={'seed\none\nsecond\nthird'}
+    step={1}
+    initialScroll={1}
+    streamId={SELECTION_STREAM_ID}
+    releasedSelection={releasedSelection}
+    recordFrame={false}
+    onPaint={(rect, options) => {
+      if (rect && options?.rememberText === false) selectionHarvests.push({ y1: rect.y1, y2: rect.y2 });
+    }}
+    onFrame={(frame) => selectionFrames.push(frame)}
+  />,
+);
+await settle(selectionInstance);
+selectionInstance.unmount();
+await selectionInstance.waitUntilExit();
+selectionInstance.cleanup();
+const growthFrames = selectionFrames.slice(framesBeforeGrowth);
+if (!growthFrames.some((frame) => frame.scrollTarget > 1)) {
+  throw new Error('released-selection repro did not apply anchored growth at offset 1');
+}
+const growthHarvests = selectionHarvests.slice(harvestsBeforeGrowth);
+const initialRenderOffset = selectionFrames[framesBeforeGrowth - 1]?.renderScrollOffset ?? 0;
+const maxGrowthRenderOffset = Math.max(
+  initialRenderOffset,
+  ...growthFrames.map((frame) => frame.renderScrollOffset),
+);
+const maxExpectedSelectionY = releasedSelection.y1 + maxGrowthRenderOffset - initialRenderOffset;
+const doubleCountedHarvest = growthHarvests.find(
+  (harvest) => harvest.y1 > maxExpectedSelectionY || harvest.y2 > maxExpectedSelectionY,
+);
+const finalHarvest = growthHarvests.at(-1);
+if (
+  doubleCountedHarvest
+  || !finalHarvest
+  || finalHarvest.y1 !== releasedSelection.y1
+  || finalHarvest.y2 !== releasedSelection.y2
+) {
+  throw new Error(`released selection harvested wrong row during anchored growth: ${JSON.stringify({
+    doubleCountedHarvest,
+    finalHarvest,
+    expectedFinal: releasedSelection,
+    maxExpectedSelectionY,
+  })}`);
+}
 console.log('tui-transcript-jitter-harness: ok');
 
 

package/src/app.mjs

@@ -3,31 +3,12 @@ import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { performance } from 'node:perf_hooks';
 import { ensureProcessListenerHeadroom } from './runtime/shared/process-listener-headroom.mjs';
+import {
+  classifyCliInvocation,
+  parseHeadlessRoleCommand,
+} from './headless-command.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
-// --workflow is consumed (with its value) but ignored on the headless role
-// path: workflow selection is Lead-session-scoped. Accepting it keeps a
-// mistakenly passed `--workflow X` from leaking "X" into the role message.
-const VALUE_OPTIONS = new Set(['--provider', '--model', '--effort', '--workflow']);
-const FLAG_OPTIONS = new Set(['--readonly', '--help', '-h', '--plain', '--react', '--remote', '--onboarding']);
-const HEADLESS_FLAG_OPTIONS = new Set(['--fast']);
-const HEADLESS_ROLE_ALIASES = new Map([
-  ['explorer', 'explore'],
-  ['explore', 'explore'],
-  ['maint', 'maintainer'],
-  ['maintenance', 'maintainer'],
-  ['maintainer', 'maintainer'],
-  ['worker', 'worker'],
-  ['heavy', 'heavy-worker'],
-  ['heavyworker', 'heavy-worker'],
-  ['heavy-worker', 'heavy-worker'],
-  ['review', 'reviewer'],
-  ['reviewer', 'reviewer'],
-  ['debug', 'debugger'],
-  ['debugger', 'debugger'],
-  ['web', 'web-researcher'],
-  ['web-researcher', 'web-researcher'],
-]);
 const BOOT_PROFILE_ENABLED = /^(1|true|yes|on)$/i.test(String(process.env.MIXDOG_BOOT_PROFILE || ''));
 const BOOT_PROFILE_START = globalThis.__mixdogBootProfileStart || (globalThis.__mixdogBootProfileStart = performance.now());
 
@@ -49,55 +30,7 @@ function bootProfile(event, fields = {}) {
   try { process.stderr.write(`${parts.join(' ')}\n`); } catch {}
 }
 
-function unknownOption(argv) {
-  for (let i = 0; i < argv.length; i += 1) {
-    const arg = argv[i];
-    if (VALUE_OPTIONS.has(arg)) {
-      i += 1;
-      continue;
-    }
-    if (FLAG_OPTIONS.has(arg)) continue;
-    if (HEADLESS_FLAG_OPTIONS.has(arg)) continue;
-    if (String(arg || '').startsWith('-')) return arg;
-  }
-  return null;
-}
-
-function positionalArgs(argv) {
-  const out = [];
-  for (let i = 0; i < argv.length; i += 1) {
-    const arg = argv[i];
-    if (VALUE_OPTIONS.has(arg)) {
-      i += 1;
-      continue;
-    }
-    if (FLAG_OPTIONS.has(arg)) continue;
-    if (HEADLESS_FLAG_OPTIONS.has(arg)) continue;
-    if (String(arg || '').startsWith('-')) continue;
-    out.push(arg);
-  }
-  return out;
-}
-
-function normalizeHeadlessAgent(value) {
-  const key = String(value || '').trim().toLowerCase().replace(/[\s_]+/g, '-');
-  return HEADLESS_ROLE_ALIASES.get(key) || null;
-}
-
-export function parseHeadlessRoleCommand(argv = []) {
-  const args = positionalArgs(argv);
-  if (args.length === 0) return null;
-
-  if (String(args[0] || '').toLowerCase() === 'role') {
-    return { error: 'usage: mixdog <role> <message...>' };
-  }
-
-  const agent = normalizeHeadlessAgent(args[0]);
-  if (!agent) return null;
-  const message = args.slice(1).join(' ').trim();
-  if (!message) return { error: `usage: mixdog ${args[0]} <message...>` };
-  return { agent, message };
-}
+export { parseHeadlessRoleCommand };
 
 /**
  * mixdog launcher.
@@ -107,57 +40,49 @@ export function parseHeadlessRoleCommand(argv = []) {
  * from this entry point.
  */
 export async function run(argv = []) {
-  bootProfile('run:start', { argv: argv.join(',') });
-  const badOption = unknownOption(argv);
-  if (badOption) {
-    process.stderr.write(`mixdog: unknown option ${badOption}\n`);
+  const invocation = classifyCliInvocation(argv);
+  // Headless commands establish their own audited environment after route
+  // validation; do not let an inherited MIXDOG_BOOT_PROFILE affect that path.
+  if (invocation.kind !== 'headless' && invocation.skipHostPrelude !== true) {
+    bootProfile('run:start', { argv: argv.join(',') });
+  }
+  if (invocation.kind === 'error') {
+    process.stderr.write(`mixdog: ${invocation.error}\n`);
     return 1;
   }
-
-  const provIdx = argv.indexOf('--provider');
-  const modelIdx = argv.indexOf('--model');
-  const effortIdx = argv.indexOf('--effort');
-  const toolMode = argv.includes('--readonly') ? 'readonly' : 'full';
-  const remote = argv.includes('--remote');
-  const forceOnboarding = argv.includes('--onboarding');
-  const opts = {
-    provider: provIdx >= 0 ? argv[provIdx + 1] : undefined,
-    model: modelIdx >= 0 ? argv[modelIdx + 1] : undefined,
-    effort: effortIdx >= 0 ? argv[effortIdx + 1] : undefined,
-    fast: argv.includes('--fast'),
-    toolMode,
-    remote,
-    forceOnboarding,
-  };
+  const opts = invocation.options;
 
   // `--help` / `-h`: keep this path tiny; do not import the REPL/runtime stack.
-  if (argv.includes('--help') || argv.includes('-h')) {
+  if (invocation.kind === 'help') {
     const { printHelp } = await import('./help.mjs');
     printHelp();
     return 0;
   }
 
   // `--plain`: the OLD readline REPL, kept as a strangler fallback.
-  if (argv.includes('--plain')) {
+  if (invocation.kind === 'plain') {
     const { runRepl } = await import('./repl.mjs');
     return await runRepl(opts);
   }
 
-  if (argv.includes('--react')) {
+  if (invocation.kind === 'react') {
     process.stderr.write('mixdog: --react was removed; run `mixdog` for the canonical TUI.\n');
     return 1;
   }
 
-  const headless = parseHeadlessRoleCommand(argv);
-  if (headless?.error) {
-    process.stderr.write(`mixdog: ${headless.error}\n`);
-    return 1;
-  }
-  if (headless) {
+  if (invocation.kind === 'headless') {
+    const { validateExplicitPristineRoute } = await import(
+      './runtime/shared/pristine-execution.mjs'
+    );
+    const routeError = validateExplicitPristineRoute(opts);
+    if (routeError) {
+      process.stderr.write(`mixdog: ${routeError}\n`);
+      return 1;
+    }
     const { runHeadlessRole } = await import('./headless-role.mjs');
     return await runHeadlessRole({
-      agent: headless.agent,
-      message: headless.message,
+      agent: invocation.headless.agent,
+      message: invocation.headless.message,
       provider: opts.provider,
       model: opts.model,
       effort: opts.effort,

package/src/cli.mjs

@@ -1,23 +1,27 @@
 #!/usr/bin/env node
 
 import { fileURLToPath } from 'node:url';
-import { performPendingSwap, registerLiveSession } from './runtime/shared/staged-update.mjs';
+import { classifyCliInvocation } from './headless-command.mjs';
 
 const argv = process.argv.slice(2);
 
-// Pre-import self-update swap: BEFORE any runtime module is imported, if a
-// completed staged newer version exists and no other mixdog session is live,
-// atomically swap the global package dir into place. Doing it here (and only
-// here) means the process goes on to load the NEW files, and a live session
-// never has its files overwritten mid-run. Any obstacle → false, run current.
 let swapped = false;
-try { swapped = performPendingSwap(); } catch { swapped = false; }
-
-// Register this process in the live-session refcount BEFORE any runtime module
-// loads, so a concurrently-launching mixdog's liveness check can see us and
-// defer its own swap. Unregister is hooked on process 'exit' (and on graceful
-// close). Harmless for the swap decision above — our own pid is excluded.
-try { registerLiveSession(); } catch { /* advisory refcount only */ }
+const invocation = classifyCliInvocation(argv);
+const skipHostPrelude = invocation.kind === 'headless' || invocation.skipHostPrelude === true;
+if (!skipHostPrelude) {
+  // Interactive/general sessions retain the staged-update and live-session
+  // semantics. Headless role commands skip both because those helpers touch the
+  // host data tree before the pristine boundary exists.
+  try {
+    const { performPendingSwap, registerLiveSession } = await import(
+      './runtime/shared/staged-update.mjs'
+    );
+    swapped = performPendingSwap();
+    try { registerLiveSession(); } catch { /* advisory refcount only */ }
+  } catch {
+    swapped = false;
+  }
+}
 
 async function main() {
   // If we actually swapped, re-exec a fresh node process so the new package

package/src/defaults/cycle3-review-prompt.md

@@ -23,7 +23,9 @@ CORE is durable standing knowledge that lands in one of three layers:
 - **L3 — Current map:** one-line project-landscape summaries, live long-running
   goals, environment anchors documented nowhere else.
 
-Every entry should be ONE short clause (≤120 chars). CORE is not a log.
+Every entry must be ONE compact ENGLISH clause (≤120 chars), regardless of
+source language. Keep identifiers, paths, and exact phrases coined by the user
+verbatim. CORE is not a log.
 
 ## The distinction that decides every verdict
 
@@ -48,8 +50,10 @@ or inconclusive, keep the CORE entry.
 
 ## Verdicts
 
-- `keep` — durable and already one short clause.
-- `update` — durable but verbose or multi-sentence → rewrite as one ≤120-char clause.
+- `keep` — durable and already one compact ENGLISH clause.
+- `update` — durable but verbose, multi-sentence, or non-English → rewrite as
+  one compact ≤120-char ENGLISH clause; keep identifiers, paths, and exact
+  phrases coined by the user verbatim.
 - `merge` — duplicates another entry → fold into the survivor (same project pool).
 - `reclassify` — the entry is filed under the WRONG project pool. Its subject
   clearly belongs to a different pool shown among the entries under review: a
@@ -81,7 +85,9 @@ or inconclusive, keep the CORE entry.
   `<id>|delete` with no reason, or any reason outside that set, is treated as
   "needs confirmation" and only removed on an explicit APPLY CYCLE3 run.
 
-A verbose durable entry is always `update`, never `keep`.
+A verbose, multi-sentence, or non-English durable entry is always `update`,
+never `keep`; rewrite it as a ≤120-char English clause while keeping
+identifiers, paths, and exact user-coined phrases verbatim.
 Delete is the rarest verdict. Prefer `keep` for durable rules/preferences and
 `update` for compression when the current behavior is still valid.
 Use `superseded` (not `delete`) when the entry WAS a valid durable rule/fact but

package/src/defaults/memory-promote-prompt.md

@@ -47,9 +47,10 @@ Use `why|A` for durable cross-session invariants (L1/L2). Use `why|B` for L3
 current-map entries: one-line project-landscape summaries, live long-running
 goals, and environment anchors documented nowhere else. `why` is validation
 evidence only; it is
-not stored. `core_summary` is injected into Core Memory, so keep it one
-self-contained clause, <=120 chars. For `merge`, `why` and `core` may use the
-survivor `target_row`.
+not stored. `core_summary` is injected into Core Memory, so write it in ENGLISH
+regardless of source language as one compact, self-contained clause, <=120
+chars. Keep code identifiers, paths, and commands verbatim. For `merge`, `why`
+and `core` may use the survivor `target_row`.
 
 Allowed primary verbs: