mixdog 0.9.87 → 0.9.89

package/src/runtime/agent/orchestrator/session/manager/usage-metrics.mjs

@@ -6,7 +6,13 @@
 // _runtimeState map (owned by manager.mjs) to read the in-memory session and
 // flag usageMetricsTurnIncremental. manager.mjs wires it via configureUsageMetricsRuntime().
 import { providerInputExcludesCache } from '../../providers/registry.mjs';
-import { loadSession, saveSessionAsync, _saveSessionSync } from '../store.mjs';
+import {
+    loadSession,
+    saveSessionAsync,
+    parkSessionSnapshotForDrain,
+    unparkSessionSnapshotForDrain,
+    registerSessionPurgeHook,
+} from '../store.mjs';
 
 // Per-session idempotency tracking: sessionId → Set of seen
 // turn:epoch:iteration:source keys.
@@ -24,46 +30,135 @@ const _metricSaveState = new Map();
 // flush. Only populated for the window between "delta applied, save not yet
 // posted to the worker" and the actual saveSessionAsync call — once a save
 // is posted, store.mjs's own _saveWorkerPending covers process-exit drain.
+// While parked, the snapshot is ALSO registered with the store's own deferred
+// map (parkSessionSnapshotForDrain), so the canonical drain — not a second
+// exit hook — persists it under the shared epoch/lock/fence ordering.
 const _pendingMetricsFlush = new Map();
 const METRICS_SAVE_THROTTLE_MS = 500;
 
 function _metricsSaveState(sessionId) {
     let state = _metricSaveState.get(sessionId);
+    if (state && state.closed) {
+        // A CLOSED state belongs to a previous incarnation of this id (hard
+        // delete or close). It is never reused — and it must not block a
+        // re-created session: drop it and mint a fresh one. The old object
+        // stays non-current, so its in-flight callbacks remain inert.
+        _metricSaveState.delete(sessionId);
+        state = null;
+    }
     if (!state) {
-        state = { inFlight: false, dirty: false, lastFlushAt: 0, timer: null, closed: false, failCount: 0 };
+        state = { inFlight: false, dirty: false, lastFlushAt: 0, timer: null, closed: false, failCount: 0, drainHandle: null };
         _metricSaveState.set(sessionId, state);
     }
     return state;
 }
 
-function _flushMetricsSave(session, sessionId) {
-    const state = _metricsSaveState(sessionId);
-    if (state.closed) return;
+// Park/unpark keep the module-local ref and the store's drain registration in
+// lock-step. The park carries the generation observed when the delta was
+// applied, so a lifecycle barrier landing later still fences it by ownership.
+function _parkMetricsSnapshot(state, sessionId, session) {
+    _pendingMetricsFlush.set(sessionId, session);
+    state.drainHandle = parkSessionSnapshotForDrain(
+        session,
+        { expectedGeneration: session.generation },
+        state.drainHandle,
+    );
+}
+
+function _unparkMetricsSnapshot(state, sessionId) {
+    // The shared map belongs to whichever state currently OWNS the id: an old
+    // (closed) callback must never erase the snapshot a re-created session
+    // parked under the same id.
+    if (!_metricSaveState.has(sessionId) || _metricSaveState.get(sessionId) === state) {
+        _pendingMetricsFlush.delete(sessionId);
+    }
+    if (!state?.drainHandle) return;
+    unparkSessionSnapshotForDrain(state.drainHandle);
+    state.drainHandle = null;
+}
+
+/**
+ * Authoritative liveness of a save-state object. A hard delete (or a close)
+ * marks the CURRENT state closed and drops it from the registry, so a callback
+ * still holding that object must never re-park, re-arm a timer or re-flush —
+ * not even for one microtask, which would be enough to re-create the file the
+ * delete just unlinked.
+ */
+function _isMetricsStateCurrent(sessionId, state) {
+    return !!state && state.closed !== true && _metricSaveState.get(sessionId) === state;
+}
+
+function _flushMetricsSave(session, sessionId, state = _metricSaveState.get(sessionId)) {
+    if (!_isMetricsStateCurrent(sessionId, state)) {
+        // Purged/closed while this flush was queued: leave no trace behind.
+        _unparkMetricsSnapshot(state, sessionId);
+        return;
+    }
     if (state.timer) { clearTimeout(state.timer); state.timer = null; }
-    _pendingMetricsFlush.delete(sessionId);
+    // The park STAYS for the whole in-flight lifecycle and carries this
+    // snapshot's identity: the save — and every retry of it — runs under the
+    // epoch and guarded options (expectedGeneration included) assigned when the
+    // delta was first deferred. Minting fresh authority on a retry would let a
+    // stale payload outrank a session save that landed in the meantime.
+    _parkMetricsSnapshot(state, sessionId, session);
+    const identity = state.drainHandle;
     state.dirty = false;
     state.inFlight = true;
     state.lastFlushAt = Date.now();
-    saveSessionAsync(session, { expectedGeneration: session.generation })
+    // Set when the store's exit drain settles this write: the drain already
+    // wrote the newest snapshot for the id and cleared its deferred handle, so
+    // that settlement is a TERMINAL ownership transfer for this identity.
+    let drainSettled = false;
+    saveSessionAsync(
+        session,
+        identity?.opts ?? { expectedGeneration: session.generation },
+        identity ? { epoch: identity.epoch, revision: identity.revision } : undefined,
+    )
         .then(() => {
+            if (!_isMetricsStateCurrent(sessionId, state)) return;
             state.failCount = 0;
+            // Durable — release the identity, but ONLY when no newer delta
+            // parked itself behind this write (that snapshot is not durable
+            // yet and must stay in the canonical drain).
+            if (!state.dirty) _unparkMetricsSnapshot(state, sessionId);
         })
         .catch((err) => {
             process.stderr.write(`[usage-metrics] iteration save failed: ${err?.message ?? err}\n`);
+            if (err?.sessionStoreDrained === true) {
+                // Drain owns durability now. Re-parking here would register a
+                // NEW identity (fresh epoch) for an old payload, which could
+                // then overwrite a save that lands after the drain; retrying
+                // would do the same. Release the identity and stay inert.
+                drainSettled = true;
+                state.dirty = false;
+                state.failCount = 0;
+                _unparkMetricsSnapshot(state, sessionId);
+                return;
+            }
+            // Hard delete / close settled this id while the write was in
+            // flight: a re-park here would put a deferred entry (and with it a
+            // drain-recreated file) back for a session that no longer exists.
+            if (!_isMetricsStateCurrent(sessionId, state)) return;
             // A rejected save must not silently drop the delta already
             // applied in-memory — re-park it so the process-exit drain
             // and/or the retry below still see it.
             state.failCount += 1;
             state.dirty = true;
-            _pendingMetricsFlush.set(sessionId, session);
+            // NEVER let the rejected closure overwrite a newer snapshot that
+            // parked while this write was in flight: the latest parked ref
+            // wins, under the same preserved identity.
+            const latest = _pendingMetricsFlush.get(sessionId);
+            _parkMetricsSnapshot(state, sessionId, latest ?? session);
         })
         .finally(() => {
             state.inFlight = false;
-            if (state.closed) {
-                // dropMetricSeenState ran while this save was in flight —
-                // do not resurrect per-session state/timers post-close.
-                _metricSaveState.delete(sessionId);
-                _pendingMetricsFlush.delete(sessionId);
+            if (drainSettled) return; // terminal: no repark, no retry, no timer
+            if (!_isMetricsStateCurrent(sessionId, state)) {
+                // dropMetricSeenState (close) or the hard-delete purge ran
+                // while this save was in flight — do not resurrect per-session
+                // state, timers or deferred entries.
+                _unparkMetricsSnapshot(state, sessionId);
+                if (_metricSaveState.get(sessionId) === state) _metricSaveState.delete(sessionId);
                 return;
             }
             // A newer delta (or the rejection re-park above) landed while
@@ -78,7 +173,7 @@ function _flushMetricsSave(session, sessionId) {
             // drain still gets a shot at persisting it.
             if (state.dirty && state.failCount <= 3) {
                 const latest = _pendingMetricsFlush.get(sessionId) ?? session;
-                _flushMetricsSave(latest, sessionId);
+                _flushMetricsSave(latest, sessionId, state);
             }
         });
 }
@@ -95,22 +190,22 @@ function _scheduleMetricsSave(session, sessionId) {
     if (state.closed) return;
     if (state.inFlight) {
         state.dirty = true;
-        _pendingMetricsFlush.set(sessionId, session);
+        _parkMetricsSnapshot(state, sessionId, session);
         return;
     }
     const elapsed = Date.now() - state.lastFlushAt;
     if (elapsed >= METRICS_SAVE_THROTTLE_MS) {
-        _flushMetricsSave(session, sessionId);
+        _flushMetricsSave(session, sessionId, state);
         return;
     }
     state.dirty = true;
-    _pendingMetricsFlush.set(sessionId, session);
+    _parkMetricsSnapshot(state, sessionId, session);
     if (!state.timer) {
         const t = setTimeout(() => {
             state.timer = null;
-            if (!state.inFlight && !state.closed) {
+            if (!state.inFlight && _isMetricsStateCurrent(sessionId, state)) {
                 const latest = _pendingMetricsFlush.get(sessionId) ?? session;
-                _flushMetricsSave(latest, sessionId);
+                _flushMetricsSave(latest, sessionId, state);
             }
         }, METRICS_SAVE_THROTTLE_MS - elapsed);
         if (t.unref) t.unref();
@@ -118,18 +213,19 @@ function _scheduleMetricsSave(session, sessionId) {
     }
 }
 
-// Process exit can land inside the throttle window, before the trailing
-// timer above ever calls saveSessionAsync (which would otherwise register
-// with store.mjs's own drainSessionStore-covered worker queue). Sync-flush
-// any such still-deferred session here so a normal-completion turn that
-// happens to exit mid-throttle never loses the latest iteration delta.
-process.on('exit', () => {
-    for (const [sessionId, session] of _pendingMetricsFlush) {
-        try { _saveSessionSync(session, { expectedGeneration: session.generation }); }
-        catch { /* best-effort: process is exiting */ }
-    }
-    _pendingMetricsFlush.clear();
-});
+// NO second exit-flush path lives here on purpose. Process exit can land
+// inside the throttle window, before the trailing timer ever calls
+// saveSessionAsync — but the parked snapshot is registered with the store's
+// own deferred map, so drainSessionStore() persists it in the canonical
+// ordering (epoch rank, fresh cancellation guard, shared commit lock,
+// ownership generation, landed-epoch fence, one global deadline). A
+// sync-flush here would instead mint fresh write authority AFTER that drain
+// and could overwrite a newer landed session or a lifecycle barrier.
+//
+// Hard delete is the mirror image: the store runs this module's own cleanup
+// synchronously (timers cancelled, park dropped, state closed) before it
+// unlinks the file, so no retry and no drain entry can resurrect it.
+registerSessionPurgeHook((sessionId) => dropMetricSeenState(sessionId));
 
 // Injected accessor for manager's _runtimeState. Defaults to a no-op lookup so
 // the pure helpers remain usable (and unit-testable) before wiring.
@@ -155,7 +251,7 @@ export function dropMetricSeenState(sessionId) {
         // that write is still outstanding.
         if (!state.inFlight) _metricSaveState.delete(sessionId);
     }
-    _pendingMetricsFlush.delete(sessionId);
+    _unparkMetricsSnapshot(state, sessionId);
 }
 
 /** Monotonic per-session ask/turn id for incremental usage idempotency. */

package/src/runtime/agent/orchestrator/session/manager.mjs

@@ -105,8 +105,10 @@ export {
     createSession,
     updateSessionRoute,
     prefetchSession,
+    prepareSessionProjection,
     resumeSession,
     isSessionOwnerGone,
+    recoverSessionAfterProcessRestart,
 } from './manager/session-lifecycle.mjs';
 export { askSession, _api_call_with_interrupt } from './manager/ask-session.mjs';
 export {
@@ -120,11 +122,13 @@ export {
     clearSessionMessages,
     compactSessionMessages,
     updateSessionStatus,
+    updateSessionGeneratedTitle,
+    updateSessionManualTitle,
     flushSessionMetrics,
 } from './manager/session-crud.mjs';
 export { deleteSession } from './store.mjs';
 // Read-only parsed-session access (desktop pane peek): no resume, no
 // ownership, no liveness side effects.
 export { loadSession } from './store.mjs';
-export { closeSession, abortSessionTurn } from './manager/session-close.mjs';
+export { closeSession, abortSessionTurn, unloadSessionRuntime } from './manager/session-close.mjs';
 export { sweepTombstones, startIdleCleanup, stopIdleCleanup } from './manager/idle-cleanup.mjs';

package/src/runtime/agent/orchestrator/session/save-session-worker.mjs

@@ -25,12 +25,85 @@ try {
 } catch { /* best-effort: worker still functions with default stdio */ }
 
 import { _saveSessionSync } from './store.mjs';
+import { applySessionSaveFault, _sessionStoreTestMode } from './store/save-fault.mjs';
+import { SAVE_OUTCOME_SAVED } from './store/live-state.mjs';
 
-parentPort.on('message', ({ session, opts, reqId }) => {
+// Per-id base transcripts for the parent's delta handoff (save-worker.mjs
+// _buildWirePayload): a delta message carries only header + appended tail and
+// is reconstructed against the messages written by this worker's previous
+// save for that id. Bounded LRU — an evicted id answers deltaMiss and the
+// parent retries with a full snapshot.
+const _baseMessages = new Map(); // id → last successfully written messages (disk shape)
+const BASE_MESSAGES_MAX = 8;
+
+function _rememberBase(id, messages) {
+    _baseMessages.delete(id);
+    _baseMessages.set(id, messages);
+    while (_baseMessages.size > BASE_MESSAGES_MAX) {
+        const oldest = _baseMessages.keys().next().value;
+        if (oldest === undefined) break;
+        _baseMessages.delete(oldest);
+    }
+}
+
+parentPort.on('message', (message) => {
+    // Authoritative fault state pushed by the parent realm. It arrives before
+    // any write that may be affected by it, and `null` clears (the worker's
+    // inherited env snapshot must never outlive the parent's config).
+    if (message && Object.prototype.hasOwnProperty.call(message, '__fault')) {
+        applySessionSaveFault(message.__fault);
+        return;
+    }
+    // TEST-ONLY, STRUCTURALLY GATED: forget the delta base of ONE id so the
+    // next delta for it legitimately misses. Nothing else in this realm (or in
+    // the parent's baseline) is touched, and the worker keeps running.
+    if (message && Object.prototype.hasOwnProperty.call(message, '__evictBase')) {
+        if (_sessionStoreTestMode() && message.__evictBase) _baseMessages.delete(message.__evictBase);
+        return;
+    }
+    // TEST-ONLY, STRUCTURALLY GATED inspector: report whether this realm still
+    // holds a delta base for one id. Read-only; nothing is mutated.
+    if (message && Object.prototype.hasOwnProperty.call(message, '__baseProbe')) {
+        if (_sessionStoreTestMode()) {
+            parentPort.postMessage({
+                __baseProbeResult: { id: message.__baseProbe, hasBase: _baseMessages.has(message.__baseProbe) },
+            });
+        }
+        return;
+    }
+    const { session, delta, id, opts, reqId } = message || {};
     try {
-        const saved = _saveSessionSync(session, opts);
-        parentPort.postMessage({ ok: true, saved, reqId });
+        let full = session;
+        const sessionId = id ?? session?.id;
+        if (!full && delta) {
+            const base = _baseMessages.get(sessionId);
+            // baseCount pins the exact chain position: the single-worker FIFO
+            // guarantees per-id ordering, so a length mismatch can only mean a
+            // broken chain (restart/eviction) — never silently reconstruct.
+            if (!base || base.length !== delta.baseCount) {
+                parentPort.postMessage({ ok: true, saved: false, deltaMiss: true, reqId });
+                return;
+            }
+            full = { ...delta.header, messages: [...base, ...delta.tailMessages] };
+        }
+        const outcome = _saveSessionSync(full, opts);
+        const saved = outcome === SAVE_OUTCOME_SAVED;
+        if (saved) _rememberBase(sessionId, full.messages);
+        else _baseMessages.delete(sessionId);
+        // `outcome` tells the parent WHY a write did not land: an
+        // ownership/cancellation drop and a stale-epoch refusal have opposite
+        // consequences for live-state markers.
+        parentPort.postMessage({ ok: true, saved, outcome, reqId });
     } catch (err) {
-        parentPort.postMessage({ ok: false, error: err?.message ?? String(err), reqId });
+        // Preserve the original failure identity across the thread boundary:
+        // the parent rebuilds an Error carrying the same code/injection marker
+        // so callers can branch on it exactly as in the sync path.
+        parentPort.postMessage({
+            ok: false,
+            error: err?.message ?? String(err),
+            errorCode: err?.code ?? null,
+            injectedSaveFault: err?.injectedSaveFault === true,
+            reqId,
+        });
     }
 });

package/src/runtime/agent/orchestrator/session/send-with-recovery.mjs

@@ -6,6 +6,7 @@
 // try/catch it replaced.
 import { appendAgentTrace } from '../agent-trace.mjs';
 import { isContextOverflowError } from '../providers/retry-classifier.mjs';
+import { readStreamOutcome } from '../providers/lib/stream-outcome.mjs';
 import { resolveWorkerCompactPolicy } from './loop/compact-policy.mjs';
 import { agentContextOverflowError } from './loop/context-overflow.mjs';
 import { estimateMessagesTokensSafe } from './loop/compact-debug.mjs';
@@ -43,6 +44,12 @@ export async function sendWithRecovery(ctx) {
         try {
             response = await provider.send(messages, model, sendTools.length ? sendTools : undefined, opts);
         } catch (sendErr) {
+            // Canonical stream outcome: ONE fail-closed read of what the
+            // provider stream actually produced (terminal vs continuation,
+            // observed text/reasoning, partial/complete/dispatched tool calls).
+            // Every branch below consumes it instead of re-inferring safety
+            // from provider-specific flags.
+            const outcome = readStreamOutcome(sendErr);
             // Gemini REST/SDK reports MAX_TOKENS by throwing a typed
             // ProviderIncompleteError after preserving the streamed candidate.
             // Normalize only that exact, safe no-tool output-limit shape into a
@@ -54,9 +61,11 @@ export async function sendWithRecovery(ctx) {
                 && isOutputLimitStopReason(sendErr.finishReason)
                 && typeof sendErr.partialContent === 'string'
                 && sendErr.partialContent.trim().length > 0
-                && sendErr.pendingToolUse !== true
-                && sendErr.emittedToolCall !== true
-                && !(Array.isArray(sendErr.partialToolCalls) && sendErr.partialToolCalls.length > 0)
+                // Terminal observed (explicit finish reason) and no tool
+                // exposure at all: the only shape safe to promote to success.
+                && outcome.successEligible === true
+                && outcome.toolCallsStarted !== true
+                && outcome.sideEffectDispatched !== true
             ) {
                 response = {
                     content: sendErr.partialContent,
@@ -71,48 +80,46 @@ export async function sendWithRecovery(ctx) {
                 };
                 return { action: 'proceed', response };
             } else
-            // Partial-final recovery (owner-notify fix): the recurring "worker
-            // finished but the task hung / no result delivered" case is a FINAL,
-            // no-tool summary stream that wedges (ping-only) AFTER all real tool
-            // work completed in earlier iterations. The provider attaches its
-            // partial stream state to the StreamStalledError. When the stall
-            // carries streamed assistant text, has NO pending tool_use, and did
-            // NOT emit a tool call this iteration, accept the partial as a
-            // successful terminal response (deliver the summary we have) instead
-            // of throwing — which would strand/notify-as-failure a turn whose
-            // work actually succeeded. A stall WITH a pending/emitted tool call
-            // is NOT recoverable (a tool whose input never completed must never
-            // look done) and falls through to the normal error path.
+            // Exhausted no-tool stall: NOT a success. A FINAL, no-tool stream
+            // that wedges (ping-only) carries streamed assistant text on the
+            // StreamStalledError, but the turn never completed — the model may
+            // have been mid-sentence, and there is no completion signal that
+            // says the work is done. Promoting it to a normal terminal response
+            // silently reported truncated/aborted turns as finished. Keep it an
+            // explicit failure (like codex's no-completed stream handling and
+            // opencode's persisted partial-failure): the already-streamed text
+            // is preserved by the interruption/error persistence path
+            // (turn-interruption.mjs records the deltas and commits them as the
+            // partial assistant message alongside the error), so nothing visible
+            // is lost while the caller/owner-notify still sees a failed turn.
+            // A stall WITH complete parsed tool calls is a different, genuinely
+            // recoverable case and is handled by the next branch.
             if (
-                sendErr?.streamStalled === true
-                && sendErr.pendingToolUse !== true
-                // NOT gated on unsafeToRetry: live-text stalls stamp
-                // unsafeToRetry=true (replay would double-render), but
-                // ACCEPTING the already-streamed partial is exactly the safe
-                // move (CC rule). Only an emitted tool call blocks acceptance.
-                && sendErr.emittedToolCall !== true
+                outcome.stallObserved === true
+                && outcome.terminalObserved !== true
                 && typeof sendErr.partialContent === 'string'
                 && sendErr.partialContent.trim().length > 0
-                && !(Array.isArray(sendErr.partialToolCalls) && sendErr.partialToolCalls.length > 0)
+                && outcome.toolCallsComplete === 0
             ) {
                 try {
                     process.stderr.write(
                         `[loop] final stream stalled with partial text (sess=${sessionId || 'unknown'} `
                         + `iter=${nextIteration} len=${sendErr.partialContent.length}); `
-                        + `accepting as partial-final success\n`,
+                        + `failing the turn (partial preserved via interrupted-turn persistence)\n`,
                     );
                 } catch { /* best-effort */ }
-                response = {
-                    content: sendErr.partialContent,
-                    model: sendErr.partialModel || model,
-                    toolCalls: undefined,
-                    usage: sendErr.partialUsage || undefined,
-                    stopReason: sendErr.partialStopReason || 'end_turn',
-                    hasThinkingContent: sendErr.partialHasThinking === true,
-                    providerMetadata: sendErr.providerMetadata,
-                    partialFinal: true,
-                };
-                return { action: 'proceed', response };
+                try {
+                    appendAgentTrace({
+                        kind: 'stall_partial_final_rejected',
+                        sessionId: sessionId || null,
+                        iteration: nextIteration,
+                        partialContentLen: sendErr.partialContent.length,
+                        pendingToolUse: outcome.pendingToolInput,
+                        emittedToolCall: outcome.sideEffectDispatched,
+                        terminalObserved: outcome.terminalObserved,
+                    });
+                } catch { /* best-effort */ }
+                throw sendErr;
             } else
             // Partial tool-call recovery (agent-hang fix): a stream that stalls
             // AFTER fully-parsed tool calls were emitted used to lose the whole
@@ -128,8 +135,9 @@ export async function sendWithRecovery(ctx) {
             // once. providerState stays undefined so the next iteration resends
             // a full frame on a fresh stream.
             if (
-                sendErr?.streamStalled === true
-                && sendErr.pendingToolUse !== true
+                outcome.stallObserved === true
+                && outcome.pendingToolInput !== true
+                && outcome.toolCallsComplete > 0
                 && Array.isArray(sendErr.partialToolCalls)
                 && sendErr.partialToolCalls.length > 0
             ) {
@@ -156,6 +164,22 @@ export async function sendWithRecovery(ctx) {
                     usage: sendErr.partialUsage || undefined,
                     stopReason: 'tool_use',
                     hasThinkingContent: sendErr.partialHasThinking === true,
+                    // Ordered provider block state captured before the stall.
+                    // Anthropic REQUIRES the verbatim thinking blocks (with
+                    // their signatures) back ahead of tool_use on the
+                    // continuation turn, and a native `server_tool_use` call is
+                    // only valid immediately followed by its result block — so
+                    // the recovered tool turn must replay exactly what a
+                    // successful turn would have returned. The loop's committer
+                    // already drops the redundant `thinkingBlocks` copy when
+                    // `assistantBlocks` is present (which contains them
+                    // verbatim), so blocks are neither lost nor doubled.
+                    ...(Array.isArray(sendErr.partialThinkingBlocks) && sendErr.partialThinkingBlocks.length
+                        ? { thinkingBlocks: sendErr.partialThinkingBlocks }
+                        : {}),
+                    ...(Array.isArray(sendErr.partialAssistantBlocks) && sendErr.partialAssistantBlocks.length
+                        ? { assistantBlocks: sendErr.partialAssistantBlocks }
+                        : {}),
                     providerMetadata: sendErr.providerMetadata,
                     partialToolRecovery: true,
                 };
@@ -175,7 +199,12 @@ export async function sendWithRecovery(ctx) {
                 throw sendErr;
             }
             const compactPolicyForRetry = resolveWorkerCompactPolicy(sessionRef, sendTools.length ? sendTools : tools);
-            if (!contextOverflowRetryUsed && compactPolicyForRetry?.auto) {
+            // The reactive retry RE-SENDS the turn, so it is a replay: denied
+            // once visible text/reasoning was relayed or a tool call was
+            // dispatched (or ambiguously dispatched). A deterministic overflow
+            // refusal that exposed nothing may compact and re-send.
+            const replayPermitted = outcome.replaySafe === true;
+            if (!contextOverflowRetryUsed && compactPolicyForRetry?.auto && replayPermitted) {
                 // Mark the next pre-send compact as REACTIVE (driven by a
                 // provider overflow refusal) rather than the normal proactive
                 // pressure trigger, so the compact event/telemetry the loop
@@ -192,7 +221,9 @@ export async function sendWithRecovery(ctx) {
             try {
                 process.stderr.write(
                     `[loop] context overflow on send (sess=${sessionId || 'unknown'} iter=${nextIteration}); ` +
-                    `surfacing overflow after reactive compact retry messages=${messages.length}\n`,
+                    `surfacing overflow (retryUsed=${contextOverflowRetryUsed === true} ` +
+                    `replaySafe=${outcome.replaySafe === true} replayUnsafe=${outcome.replayUnsafe === true}) ` +
+                    `messages=${messages.length}\n`,
                 );
             } catch { /* best-effort */ }
             throw agentContextOverflowError({

package/src/runtime/agent/orchestrator/session/store/fs-probe.mjs

@@ -0,0 +1,91 @@
+/**
+ * Existence probes that never conflate "not there" with "cannot look".
+ *
+ * `existsSync` returns false for EVERY stat failure — ENOENT, but also
+ * EACCES/EIO/EBUSY/EPERM/ELOOP. Every store decision keyed on that boolean
+ * therefore reads a temporarily unreadable file as a DELETED one: the sweep
+ * queues its summary row for removal, sidecar rebuilds drop it, sidecars get
+ * unlinked as orphans and in-memory state is allowed to stand in for it.
+ * Absence is a fact; a failed probe is an unknown, and an unknown may never
+ * authorize a deletion or a fallback.
+ */
+import { readFileSync, statSync } from 'fs';
+
+export const PROBE_PRESENT = 'present';
+export const PROBE_ABSENT = 'absent';
+export const PROBE_UNREADABLE = 'unreadable';
+
+// ONLY these mean "nothing is at this path". Everything else means a file is
+// very likely there and we simply cannot look at it (same classification the
+// session load path uses).
+const ABSENT_CODES = new Set(['ENOENT', 'ENOTDIR']);
+
+// Deterministic fault seam (tests only): invoked with the path before every
+// stat and every read (`phase` is 'stat' or 'read'); returning an Error makes
+// that syscall fail. Structurally gated — without the explicit test-mode env
+// the hook cannot be installed and an already installed one goes inert.
+const PROBE_FAULT_ENV = 'MIXDOG_SESSION_LOAD_FAULT_HOOKS';
+let _probeFaultHook = null;
+
+export function _setStatProbeFaultHook(hook) {
+    if (process.env[PROBE_FAULT_ENV] !== '1') {
+        _probeFaultHook = null;
+        return false;
+    }
+    _probeFaultHook = typeof hook === 'function' ? hook : null;
+    return _probeFaultHook !== null;
+}
+
+function _probeFault(path, phase) {
+    if (!_probeFaultHook) return;
+    if (process.env[PROBE_FAULT_ENV] !== '1') {
+        _probeFaultHook = null; // gate revoked after install: stay inert
+        return;
+    }
+    const injected = _probeFaultHook(path, phase);
+    if (injected instanceof Error) throw injected;
+}
+
+/**
+ * `{ state, mtimeMs, size, code }` — state is exactly one of
+ * present / absent / unreadable.
+ */
+export function probePath(path) {
+    try {
+        _probeFault(path, 'stat');
+        const info = statSync(path);
+        return { state: PROBE_PRESENT, mtimeMs: info.mtimeMs || 0, size: info.size, code: null };
+    } catch (err) {
+        const code = err?.code || 'EUNKNOWN';
+        if (ABSENT_CODES.has(code)) return { state: PROBE_ABSENT, mtimeMs: 0, size: 0, code };
+        return { state: PROBE_UNREADABLE, mtimeMs: 0, size: 0, code };
+    }
+}
+
+/**
+ * Read a text file with the SAME three-way classification.
+ * `{ state, text, code }` — 'present' carries the text, 'absent' means the
+ * file is provably gone, 'unreadable' means it very likely exists and could
+ * not be read (EACCES/EIO/EBUSY): the caller must retain whatever authority
+ * it already had instead of treating the content as missing.
+ */
+export function readTextFile(path) {
+    try {
+        _probeFault(path, 'read');
+        return { state: PROBE_PRESENT, text: readFileSync(path, 'utf8'), code: null };
+    } catch (err) {
+        const code = err?.code || 'EUNKNOWN';
+        if (ABSENT_CODES.has(code)) return { state: PROBE_ABSENT, text: '', code };
+        return { state: PROBE_UNREADABLE, text: '', code };
+    }
+}
+
+/** True only for a positively observed file/dir. */
+export function probeExists(path) {
+    return probePath(path).state === PROBE_PRESENT;
+}
+
+/** True only when the path is PROVEN absent (never for an unreadable probe). */
+export function probeAbsent(path) {
+    return probePath(path).state === PROBE_ABSENT;
+}