mixdog 0.9.88 → 0.9.89

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.88",
+  "version": "0.9.89",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",

package/src/rules/shared/01-tool.md

@@ -8,43 +8,33 @@
   identifier/relation→`code_graph` before grep; known file/span→`read`
   directly without `grep`; verified directory→`list`; known edit→
   `apply_patch` directly, with no preparatory `read`;
-  program/state change→`shell`; web/current external info→`search`. Use grep
-  only for a requested literal occurrence or after graph zero/error.
-- Batch compatible targets and combine variants, symbols, scopes, paths, and
-  queries. Parallelize distinct facets only, never alternative routes for one
-  facet. Put independent calls in one turn; they run concurrently regardless
-  of tool — shell included. Later turns are only for targets dependent on
-  prior results or unresolved facets. Only apply_patch executes in order.
-- After locator results, collect all known candidate files/regions before
-  inspection. Batch compatible reads, including same-file regions — real
-  `{path,offset,limit}` arrays covering the whole logical unit — in one
-  `path[]` call and graph targets in arrays. Parallelize independent
-  incompatible read-only inspections. Never page or reread returned spans,
-  and do not start a singleton while a known compatible candidate remains.
-  Put all new edits in one patch.
-- Project root, session cwd, user-provided and tool-returned paths are
-  verified. Use `find` first for every genuinely guessed path/name fragment, in
-  the same turn as independent probes. Never find verified roots or use
-  `path:"."` with guessed `src/**`. On ENOENT, find the basename; never retry
-  the guess. Unscoped root grep/glob/list requires no find.
+  program/state change→`shell`; web/current external info→`search`.
+- Shortest total calls, maximum batching — every turn. Combine variants,
+  symbols, scopes, paths, and queries into one call; put all independent
+  calls (probes, reads, hypotheses, commands) in one message — concurrent
+  regardless of tool, shell included. Sequential singles only for a
+  genuinely dependent next step. Distinct facets, not alternative routes.
+  Only apply_patch executes in order.
+- Batch compatible reads — same-file regions as real `{path,offset,limit}`
+  arrays covering the whole logical unit — in one `path[]` call, and graph
+  targets in arrays. Don't reread returned spans. Put all new edits in one
+  patch.
+- Verified paths: project root, session cwd, user-provided, tool-returned.
+  `find` first for guessed path/name fragments (same turn as other probes);
+  on ENOENT, find the basename.
 - At task start, batch all `explore` facets in one `query[]` call, maximum 8,
   without rephrased duplicates. Retry `EXPLORATION_FAILED` once with changed
   tokens.
-- Stop when evidence covers the deliverable; never re-locate, re-verify, or
-  upgrade a sufficient anchor. A returned requested `path:line`
-  freezes the LOCATION only; when content was not returned,
-  read or code_graph detail inspection is valid — never re-locate it.
-- Give grep content mode enough `-C` to avoid rereads; a sufficient contextual
-  grep means no overlapping `read`. After `files_with_matches`, `count`,
-  capped, or insufficient context, inspect only missing content. A nonzero
-  `content_with_context` result resolves the concept; act directly without
-  re-search; only zero/error results permit token or scope changes.
+- Stop when evidence covers the deliverable; don't re-locate or re-verify a
+  sufficient anchor. A returned `path:line` freezes the location; inspecting
+  its content with read/code_graph is valid.
+- A nonzero `content_with_context` result resolves that concept — act on it;
+  only zero/error results justify changed tokens or scope.
 - `apply_patch` is the primary edit tool: send the patch as soon as the target
   path and new content are known. `read` is for discovery or for recovery
   after a patch failed on insufficient context.
-- Apply edits before verification, then verify in a separate shell turn and
-  consume results in order. Otherwise remain parallel.
-- A long-running command promoted to background is a decision point, not a
-  cue to wait: estimate whether observed progress can finish within budget;
-  otherwise diagnose the bottleneck and switch routes. Choose waiting
-  explicitly.
+- A shell placed after `apply_patch` in the same turn runs after the patch
+  lands — batch edits and their verification freely.
+- A command promoted to background is a decision point: continue only if
+  observed progress fits the budget, otherwise switch routes. Waiting is an
+  explicit choice.

package/src/runtime/agent/orchestrator/session/agent-loop.mjs

@@ -81,6 +81,7 @@ import {
 } from './loop/tool-helpers.mjs';
 import {
     compactToolCallsForHistory,
+    compactSettledToolCallBodies,
     restoreToolCallBodyForId,
 } from './loop/stored-tool-args.mjs';
 import { repairTranscriptBeforeProviderSend } from './loop/transcript-repair.mjs';
@@ -216,6 +217,11 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
     // Reasoning/thinking deltas, tool calls, and the final answer are kept.
     const suppressMidTurnText = isAgentOwner(sessionRef);
     if (suppressMidTurnText) opts.onTextDelta = undefined;
+    // Deferred mutation-body compaction: bodies left verbatim by a previous
+    // turn's push (deferBodies below) collapse to markers now — the model has
+    // already seen them on that turn's follow-up send. Failed bodies stay
+    // verbatim for retry.
+    compactSettledToolCallBodies(messages);
     // ---- Codex turn stop hook (refs/codex core/src/session/turn.rs:372-404) --
     // A no-tool assistant message is TERMINAL. Only a structured provider
     // follow-up signal (end_turn=false / pause_turn), pending input, tool
@@ -938,7 +944,12 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             // response.content (the real result rides the later final-answer
             // turn). Blank it so it never accumulates as input tokens.
             content: suppressMidTurnText ? '' : (response.content || ''),
-            toolCalls: compactToolCallsForHistory(calls),
+            // deferBodies: mutation bodies (patch / old_string / ...) stay
+            // verbatim through the send that answers this batch, then the
+            // compactSettledToolCallBodies sweep below collapses them. This
+            // keeps a model that patches twice in a row from ever seeing (and
+            // copying) a compacted marker where its own last patch should be.
+            toolCalls: compactToolCallsForHistory(calls, { deferBodies: true }),
             // MIXED Anthropic turn (native server tools + client tool_use):
             // the ordered `server_tool_use` / `*_tool_result` blocks exist ONLY
             // in this verbatim list and are order-bound (a result block is
@@ -972,6 +983,10 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                 ? { providerMetadata: response.providerMetadata }
                 : {}),
         }, opts);
+        // Settle earlier deferred bodies before this turn's message lands:
+        // every previous call already has its result row, so successful bodies
+        // compact to markers while failed ones keep their full retry text.
+        compactSettledToolCallBodies(messages);
         messages.push(_assistantTurnMsg);
         try { opts.onAssistantMessageCommitted?.(_assistantTurnMsg); } catch {}
         const _callsToExecute = calls;

package/src/runtime/agent/orchestrator/session/eager-dispatch.mjs

@@ -7,7 +7,7 @@
 // serial batch loop.
 import { normalizeToolEnvelope } from './tool-envelope.mjs';
 import { isInvalidToolArgsMarker } from '../providers/openai-compat-stream.mjs';
-import { _intraTurnSig, _isReadTool, _isScopedCacheableTool, _stripMcpPrefix } from './loop/tool-classify.mjs';
+import { _intraTurnSig, _isMutationTool, _isReadTool, _isScopedCacheableTool, _isShellTool, _stripMcpPrefix } from './loop/tool-classify.mjs';
 import { tryReadCached, tryScopedToolCached } from './read-dedup.mjs';
 import { preDispatchDenyForSession } from './loop/pre-dispatch-deny.mjs';
 import { executeTool } from './loop/tool-exec.mjs';
@@ -40,6 +40,18 @@ export function createEagerDispatcher({
         // resets at the turn boundary without leaking across getIterations().
         const _eagerInFlightSigs = new Map();
         const epoch = { mutation: 0 };
+        // Patch→shell ordering insurance: a shell call that appears AFTER an
+        // apply_patch in the same assistant turn must not eager-start before
+        // that patch has executed (serial body runs both in call order).
+        // Reads are already safe via the mutationEpoch re-execution gate;
+        // only shell's side effects would consume pre-patch file state.
+        let _streamSawMutation = false;
+        const _hasEarlierMutation = (calls, index) => {
+            for (let k = 0; k < index; k += 1) {
+                if (_isMutationTool(calls[k]?.name)) return true;
+            }
+            return false;
+        };
         const startEagerTool = (call) => {
             if (!call?.id || pending.has(call.id) || !isParallelDispatchable(call.name)) return null;
             // Never eager-execute a call whose arguments failed to parse
@@ -163,6 +175,9 @@ export function createEagerDispatcher({
                 // later calls keep starting in parallel past it.
                 if (!call?.id || !isParallelDispatchable(call.name)) continue;
                 if (dupSet && dupSet.has(call.id)) continue;
+                // Patch→shell insurance: leave a shell that follows an
+                // apply_patch to the serial body so it runs after the patch.
+                if (_isShellTool(call.name) && _hasEarlierMutation(calls, j)) continue;
                 // A null return here is NOT a state barrier. It means a
                 // non-barrier stub — intra-turn in-flight dup, repeat-failure /
                 // cross-turn dedup, pre-dispatch-deny, invalid-args, or a cache
@@ -173,7 +188,9 @@ export function createEagerDispatcher({
             }
         };
         const onToolCall = (call) => {
+            if (_isMutationTool(call?.name)) { _streamSawMutation = true; return; }
             if (!isParallelDispatchable(call?.name)) return;
+            if (_streamSawMutation && _isShellTool(call.name)) return;
             startEagerTool(call);
         };
     return { pending, epoch, startEagerTool, startEagerRun, onToolCall };

package/src/runtime/agent/orchestrator/session/loop/stored-tool-args.mjs

@@ -5,6 +5,14 @@
 // patch text is the model's own draft, and leaving only the marker made models
 // copy `[mixdog compacted …]` back as literal patch input. Bodies of calls that
 // did NOT fail stay compacted so an already-applied patch cannot be replayed.
+//
+// Mutation bodies additionally get ONE turn of grace: the push that commits a
+// tool-call turn defers body compaction (deferBodies), so the send that
+// immediately follows a successful patch still shows the model its own patch
+// verbatim. compactSettledToolCallBodies then collapses settled successful
+// bodies to markers on the next push / loop entry. This closes the observed
+// failure where a model writing a follow-up patch right after a success copies
+// the marker it was just shown as literal patch input.
 import { createHash } from 'crypto';
 
 const STORED_TOOL_ARG_BODY_KEY_RE = /^(?:content|old_string|new_string|patch|rewrite)$/i;
@@ -20,14 +28,20 @@ const STORED_TOOL_ARG_LIMIT = 10_000;
 const STORED_TOOL_ARG_PREVIEW_HEAD = 360;
 const STORED_TOOL_ARG_PREVIEW_TAIL = 160;
 
-function compactStoredToolArgString(value, key = '') {
+function compactStoredToolArgString(value, key = '', opts = {}) {
     if (typeof value !== 'string') return value;
     const isBody = STORED_TOOL_ARG_BODY_KEY_RE.test(key);
+    if (isBody && opts.deferBodies === true) return value;
     const isLong = isBody || STORED_TOOL_ARG_LONG_KEY_RE.test(key);
     const limit = isLong ? STORED_TOOL_ARG_LIMIT : Infinity;
     if (value.length <= limit) return value;
     const hash = createHash('sha256').update(value).digest('hex').slice(0, 16);
-    const marker = `[mixdog compacted ${key || 'string'}: ${value.length} chars, sha256:${hash}; do not copy]`;
+    // Body markers carry the recovery instruction inline: the compaction
+    // detectors only require the `[mixdog compacted ...]` shape (no ']' or
+    // newline inside), so the longer text stays fully compatible.
+    const marker = isBody
+        ? `[mixdog compacted ${key}: ${value.length} chars, sha256:${hash}; already applied - do not copy; re-read the file and write a fresh patch]`
+        : `[mixdog compacted ${key || 'string'}: ${value.length} chars, sha256:${hash}; do not copy]`;
     // Body args (patch / old_string / new_string / content / rewrite) are
     // apply_patch / edit inputs. Keeping a head/tail preview leaves real patch
     // fragments (a "*** Begin Patch" opening, diff lines) inside a SUCCESSFUL
@@ -40,32 +54,60 @@ function compactStoredToolArgString(value, key = '') {
     return `${marker}\n${head}\n... [middle omitted from stored tool-call args] ...\n${tail}`;
 }
 
-function compactStoredToolArgValue(value, key = '', depth = 0) {
+function compactStoredToolArgValue(value, key = '', depth = 0, opts = {}) {
     if (value === null || value === undefined) return value;
-    if (typeof value === 'string') return compactStoredToolArgString(value, key);
+    if (typeof value === 'string') return compactStoredToolArgString(value, key, opts);
     if (typeof value !== 'object') return value;
     if (depth >= 6) return Array.isArray(value) ? `[${value.length} items]` : '{...}';
     if (Array.isArray(value)) {
-        return value.map((item) => compactStoredToolArgValue(item, key, depth + 1));
+        return value.map((item) => compactStoredToolArgValue(item, key, depth + 1, opts));
     }
     const out = {};
     for (const [k, v] of Object.entries(value)) {
-        out[k] = compactStoredToolArgValue(v, k, depth + 1);
+        out[k] = compactStoredToolArgValue(v, k, depth + 1, opts);
     }
     return out;
 }
 
-export function compactToolCallsForHistory(calls) {
+export function compactToolCallsForHistory(calls, opts = {}) {
     if (!Array.isArray(calls)) return calls;
     return calls.map((call) => {
         if (!call || typeof call !== 'object') return call;
         return {
             ...call,
-            arguments: compactStoredToolArgValue(call.arguments),
+            arguments: compactStoredToolArgValue(call.arguments, '', 0, opts),
         };
     });
 }
 
+// Collapse the body args of every SETTLED, non-failed tool call in history to
+// their compacted markers. Runs at loop entry and before each new assistant
+// push, so a deferred verbatim body survives exactly the send(s) that follow
+// its own turn and no longer. Contract guards:
+//   - a call whose result is an error keeps its full body (retry-safe, same
+//     contract as restoreToolCallBodyForId);
+//   - a call with no result row yet (current batch / interrupted turn) is
+//     left untouched.
+export function compactSettledToolCallBodies(messages) {
+    if (!Array.isArray(messages)) return;
+    const resultKinds = new Map();
+    for (const message of messages) {
+        if (message?.role === 'tool' && message.toolCallId) {
+            resultKinds.set(message.toolCallId, message.toolKind || 'normal');
+        }
+    }
+    for (const message of messages) {
+        if (message?.role !== 'assistant' || !Array.isArray(message.toolCalls)) continue;
+        for (const call of message.toolCalls) {
+            if (!call || typeof call !== 'object') continue;
+            if (!call.arguments || typeof call.arguments !== 'object') continue;
+            const kind = call.id ? resultKinds.get(call.id) : undefined;
+            if (kind === undefined || kind === 'error') continue;
+            call.arguments = compactStoredToolArgValue(call.arguments);
+        }
+    }
+}
+
 // Restore retry-safe long command/script text for ONE failed tool call inside a
 // history assistant message whose toolCalls were compacted at push time.
 // Mutation bodies (patch, old_string, new_string, content, rewrite) are restored

package/src/runtime/agent/orchestrator/tools/builtin/builtin-tools.mjs

@@ -36,7 +36,7 @@ export const BUILTIN_TOOLS = [
         name: 'read',
         title: 'Mixdog Read',
         annotations: { title: 'Mixdog Read', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, compressible: false },
-        description: 'Read file contents; guessed path/name → find first. Batch paths/regions as real arrays: path[] or {path,offset,limit}[] regions in one call. Not for directories.',
+        description: 'Read file contents. Batch paths/regions as real arrays: path[] or {path,offset,limit}[] regions in one call. Not for directories.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -74,8 +74,8 @@ export const BUILTIN_TOOLS = [
         name: 'shell',
         title: 'Mixdog Shell',
         annotations: { title: 'Mixdog Shell', readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, compressible: true },
-        description: 'Run programs/change state; not file inspection. Calls in one turn run parallel; '
-            + 'combine order-dependent commands. Use async for sleep/watch/dev loops.'
+        description: 'Run programs/change state; not file inspection. '
+            + 'Combine order-dependent commands into one command. Use async for sleep/watch/dev loops.'
             + `${_shellSyntaxCheat} ${TOOL_ASYNC_EXECUTION_CONTRACT}`,
         inputSchema: {
             type: 'object',
@@ -123,7 +123,7 @@ export const BUILTIN_TOOLS = [
                         { type: 'string' },
                         { type: 'array', items: { type: 'string' }, minItems: 1 },
                     ],
-                    description: 'Text/regex; pattern[] batches variants in one call. path[] batches verified scopes only; file/span reads use read path[] regions.',
+                    description: 'Text/regex; pattern[] batches variants in one call.',
                 },
                 path: {
                     anyOf: [
@@ -154,7 +154,7 @@ export const BUILTIN_TOOLS = [
         name: 'glob',
         title: 'Mixdog Glob',
         annotations: { title: 'Mixdog Glob', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, compressible: true },
-        description: 'Match exact glob patterns from verified base directories (project root is verified); guessed root/name → find first. Batch pattern[]/path[].',
+        description: 'Match exact glob patterns from verified base directories (project root is verified). Batch pattern[]/path[].',
         inputSchema: {
             type: 'object',
             properties: {

package/src/runtime/agent/orchestrator/tools/builtin/shell-job-paths.mjs

@@ -113,7 +113,7 @@ async function sweepStaleShellJobs(dir) {
     });
     await Promise.all([
         ...expired.flatMap((jobId) =>
-            ['.json', '.done', '.exit', '.enforced', '.exit.cmd.sh', '.exit.cmd.ps1', '.exit.user.ps1', '.stdout.log', '.stderr.log'].map((ext) =>
+            ['.json', '.done', '.exit', '.enforced', '.guardian', '.exit.cmd.sh', '.exit.cmd.ps1', '.exit.user.ps1', '.stdout.log', '.stderr.log'].map((ext) =>
                 fsPromises.unlink(join(dir, jobId + ext)).catch(() => {}),
             ),
         ),
@@ -212,6 +212,11 @@ export function shellJobDonePath(jobId) { return join(getShellJobsDir(), `${jobI
 // wrapper's own env/cwd resolution). PS jobs don't need it — their wrapper
 // enforces unconditionally and records detail.timeoutEnforced:true.
 export function shellJobEnforcedPath(jobId) { return join(getShellJobsDir(), `${jobId}.enforced`); }
+// Guardian kill receipt: written by the detached child-guardian immediately
+// before it force-kills the job tree (host memory floor / orphaned parent).
+// Its existence lets refreshShellJob attribute a marker-less death to the
+// guardian instead of reporting an unexplained unknown exit.
+export function shellJobGuardianReceiptPath(jobId) { return join(getShellJobsDir(), `${jobId}.guardian`); }
 // Owner sidecar marker: a zero-byte file whose NAME encodes the owning CC host
 // (claude.exe) pid — `<jobId>.owner-<pid>`. It lets the statusline owner-filter
 // jobs from a SINGLE directory listing (no per-job JSON read) so the filter can

package/src/runtime/agent/orchestrator/tools/builtin/shell-job-spawn.mjs

@@ -27,6 +27,7 @@ import {
     shellJobExitPath,
     shellJobDonePath,
     shellJobEnforcedPath,
+    shellJobGuardianReceiptPath,
     resolveJobOwnerHostPid,
     trimShellJobSpill,
     writeShellJobDetail,
@@ -71,7 +72,13 @@ globalThis.__mixdogShellJobsRuntimeLoaded = true;
 // Poll cadence for the adopted-job output-cap self-tick (mirrors the
 // foreground sizeWatchdog in shell-command.mjs).
 
-import { refreshShellJob, trackChildUntilConfirmedExit, releaseShellJobOwnershipWhenQuiescent, TIMER_MAX_MS } from './shell-jobs.mjs';
+import {
+    refreshShellJob,
+    trackChildUntilConfirmedExit,
+    releaseShellJobOwnershipWhenQuiescent,
+    reconcileShellJobAfterQuiescence,
+    TIMER_MAX_MS,
+} from './shell-jobs.mjs';
 
 export async function _startBackgroundShellJobImpl({
     command, timeoutMs, workDir, mergeStderr, spawnEnv, shell, shellArg, shellArgs,
@@ -262,6 +269,7 @@ export async function _startBackgroundShellJobImpl({
         childGroupPid: child.pid,
         label: 'shell-job',
         protectHostMemory: true,
+        receiptPath: shellJobGuardianReceiptPath(jobId),
     });
     _installShellJobsExitHook();
     _registerLiveJobPid(child.pid, jobId);
@@ -269,6 +277,10 @@ export async function _startBackgroundShellJobImpl({
     releaseShellJobOwnershipWhenQuiescent(jobId, child.pid, {
         allowLateLease: true,
         deferUntilRootExit: true,
+        // Exit-event ownership (CC-aligned): when the whole tree is gone but
+        // the wrapper never published markers, settle the job honestly instead
+        // of leaving a permanently-'running' or falsely-'failed' record.
+        onConfirmed: () => { try { reconcileShellJobAfterQuiescence(jobId); } catch { /* best-effort */ } },
     });
     // Deadline cleanup poke only when a timeout is enforced; an unlimited
     // (timeoutMs<=0) job has no deadline — completion is observed via the
@@ -505,6 +517,7 @@ async function startBackgroundPowerShellJob({
         childGroupPid: childPid,
         label: 'shell-job-powershell',
         protectHostMemory: true,
+        receiptPath: shellJobGuardianReceiptPath(jobId),
     });
     _installShellJobsExitHook();
     _registerLiveJobPid(childPid, jobId);
@@ -512,6 +525,7 @@ async function startBackgroundPowerShellJob({
     releaseShellJobOwnershipWhenQuiescent(jobId, childPid, {
         allowLateLease: true,
         deferUntilRootExit: true,
+        onConfirmed: () => { try { reconcileShellJobAfterQuiescence(jobId); } catch { /* best-effort */ } },
     });
     if (Number(timeoutMs) > 0) {
         const timer = setTimeout(() => { refreshShellJob(jobId); }, Math.min(TIMER_MAX_MS, timeoutMs + 25));

package/src/runtime/agent/orchestrator/tools/builtin/shell-jobs.mjs

@@ -27,6 +27,7 @@ import {
     shellJobExitPath,
     shellJobDonePath,
     shellJobEnforcedPath,
+    shellJobGuardianReceiptPath,
     resolveJobOwnerHostPid,
     trimShellJobSpill,
     writeShellJobDetail,
@@ -134,6 +135,65 @@ export function killShellJob(jobId) {
     return { ...attachJobInsights(detail), killed: true };
 }
 
+// CC-aligned verdict for a job whose tracked root process died WITHOUT the
+// wrapper publishing the done marker. Evidence order:
+//   1. exit file — the wrapper writes exit BEFORE done, so a kill in that
+//      window still left the real exit code; recover it instead of guessing.
+//   2. guardian receipt — the child-guardian records why it force-killed the
+//      tree (host memory floor / orphaned parent) before killing.
+//   3. otherwise — honest unknown: terminal 'failed' with exitCode null and
+//      an explicit "exit status unknown" error; spilled output is preserved
+//      and the completion notification carries its tail.
+function finalizeMarkerlessShellJob(detail) {
+    const jobId = detail.jobId;
+    detail.finishedAt = new Date().toISOString();
+    let recoveredExit = null;
+    try {
+        const raw = readFileSync(shellJobExitPath(jobId), 'utf-8').trim();
+        const parsed = parseInt(raw, 10);
+        if (Number.isFinite(parsed)) recoveredExit = parsed;
+    } catch { /* no exit file */ }
+    if (recoveredExit !== null) {
+        detail.status = recoveredExit === 0 ? 'completed' : 'failed';
+        detail.exitCode = recoveredExit;
+        detail.note = 'done marker missing; exit code recovered from exit file';
+    } else {
+        let receipt = null;
+        try {
+            receipt = JSON.parse(readFileSync(shellJobGuardianReceiptPath(jobId), 'utf-8'));
+        } catch { /* no guardian receipt */ }
+        detail.status = 'failed';
+        detail.exitCode = 137;
+        if (receipt?.reason === 'host-memory-floor') {
+            const freeMb = Math.round(Number(receipt.freeBytes || 0) / (1024 * 1024));
+            const floorMb = Math.round(Number(receipt.minFreeMemoryBytes || 0) / (1024 * 1024));
+            detail.killedByGuardian = true;
+            detail.error = `killed by child guardian: host free memory ${freeMb} MB fell below the ${floorMb} MB floor — job tree force-killed to protect the host; retry with lower concurrency or after memory recovers`;
+        } else if (receipt?.reason === 'parent-exit') {
+            detail.killedByGuardian = true;
+            detail.error = 'killed by child guardian: owning runtime process exited (session cleanup)';
+        } else {
+            detail.exitCode = null;
+            detail.error = 'exit status unknown — tracked process exited without reporting an exit code; spilled output preserved (see stdout tail)';
+        }
+    }
+    trimShellJobSpill(detail);
+    writeShellJobDetail(detail);
+    releaseShellJobOwnershipWhenQuiescent(jobId, detail.pid);
+    return detail;
+}
+
+// Quiescence-deferred reconcile for the owning runtime: called when the
+// spawn-time process-tree tracker confirms the whole tree is gone. If the
+// wrapper never published markers (e.g. it was force-killed while detached
+// descendants kept running), settle the job honestly now.
+export function reconcileShellJobAfterQuiescence(jobId) {
+    const detail = readShellJobDetail(jobId);
+    if (!detail || detail.status !== 'running') return detail;
+    if (existsSync(shellJobDonePath(jobId))) return refreshShellJob(jobId);
+    return finalizeMarkerlessShellJob(detail);
+}
+
 export function refreshShellJob(jobId) {
     const detail = readShellJobDetail(jobId);
     if (!detail) return null;
@@ -207,11 +267,31 @@ export function refreshShellJob(jobId) {
         return detail;
     }
     if (detail.pid && !isPidAlive(detail.pid)) {
-        detail.status = 'failed';
-        detail.finishedAt = new Date().toISOString();
-        detail.error = 'process exited without completion marker';
-        writeShellJobDetail(detail);
-        releaseShellJobOwnershipWhenQuiescent(jobId, detail.pid);
+        // Root process died without markers. If this runtime owns a live
+        // process-tree tracker that still sees descendants (a killed wrapper
+        // whose real workload survived — observed with detached grandchildren),
+        // the JOB is still running: keep status 'running', flag the root exit,
+        // and let tree quiescence settle it via reconcileShellJobAfterQuiescence.
+        const trackerEntry = shellJobQuiescenceTrackers.get(jobId);
+        if (trackerEntry?.tracker?.pending) {
+            if (!detail.rootExitedAt) {
+                detail.rootExitedAt = new Date().toISOString();
+                detail.note = 'root process exited without an exit report; descendants still running — tracking tree to completion';
+                writeShellJobDetail(detail);
+                // Belt-and-braces for jobs without a spawn-time onConfirmed
+                // (adopted/legacy): settle once the tree is confirmed gone.
+                // Guarded by the rootExitedAt stamp so poll ticks cannot grow
+                // the callback set unboundedly.
+                trackerEntry.callbacks.add(() => reconcileShellJobAfterQuiescence(jobId));
+            }
+            // Root death is now observed: let the deferred tracker start
+            // confirming tree quiescence (idempotent past the first call).
+            trackerEntry.tracker.rootExited?.();
+            return detail;
+        }
+        // No live tracker (cross-process reader or tree already quiescent):
+        // settle now with the strongest available evidence.
+        return finalizeMarkerlessShellJob(detail);
     }
     return detail;
 }

package/src/runtime/agent/orchestrator/tools/patch/matcher.mjs

@@ -439,6 +439,25 @@ export function findLineSequence(lines, needle, fromLine, preferredLine = 0, opt
       return starts[0];
     }
   }
+  // Whole-file unique-verbatim fallback: an @@ anchor that matched a LATER
+  // occurrence, or a previous hunk that advanced the cursor, leaves the
+  // forward-only search blind to a block that exists verbatim EARLIER in the
+  // file (measured: the majority of real context-miss failures). Accept that
+  // block ONLY when it matches exactly once in the entire file — zero
+  // ambiguity about where it belongs — and never for `*** End of File` hunks.
+  // assertSafeReplacementPlan still rejects any overlap with another hunk's
+  // replacement, so a rewound match can not silently collide.
+  if (fuzzy && !eof && minStart > 0) {
+    const starts = [];
+    for (let i = 0; i + needle.length <= lines.length && starts.length < 2; i++) {
+      let ok = true;
+      for (let k = 0; k < needle.length; k++) {
+        if (lines[i + k] !== needle[k]) { ok = false; break; }
+      }
+      if (ok) starts.push(i);
+    }
+    if (starts.length === 1) return starts[0];
+  }
   if (fuzzy && needle.length === 1) {
     const want = String(needle[0] ?? '').replace(/\s+/g, ' ').trim();
     if (want.length >= 40) {

package/src/runtime/agent/orchestrator/tools/patch/orchestrator.mjs

@@ -298,6 +298,13 @@ async function applyPatchSequence(patchStr, requestedFormat, basePath, ctx) {
       for (const entry of parsed || []) {
         const kind = classifyEntry(entry);
         const headerName = kind === 'create' ? entry.newFileName : entry.oldFileName;
+        if (!headerName) {
+          throw new Error(
+            'apply_patch: a file section header could not be parsed (no target path) — the patch body is not a valid diff. '
+            + 'Each section must start with `*** Update File: <path>` / `*** Add File: <path>` / `*** Delete File: <path>` '
+            + '(V4A, wrapped in `*** Begin Patch` / `*** End Patch`), or a `--- a/<path>` + `+++ b/<path>` pair (unified).',
+          );
+        }
         units.push({
           displayPath: normalizeOutputPath(stripDiffPrefix(headerName || '')),
           fullPath: parsedEntryResolvedPath(entry, basePath),

package/src/runtime/agent/orchestrator/tools/patch/paths.mjs

@@ -24,6 +24,16 @@ export function stripDiffPrefix(name) {
 }
 
 export function resolveEntryPath(basePath, rawName) {
+  // A parsed entry without a header path (jsdiff parses arbitrary non-diff
+  // text into a headerless entry) must fail as a patch-format error, not as a
+  // raw `The "path" argument must be of type string` TypeError from node:path.
+  if (rawName == null || rawName === '') {
+    throw new Error(
+      'apply_patch: a file section header could not be parsed (no target path) — the patch body is not a valid diff. '
+      + 'Each section must start with `*** Update File: <path>` / `*** Add File: <path>` / `*** Delete File: <path>` '
+      + '(V4A, wrapped in `*** Begin Patch` / `*** End Patch`), or a `--- a/<path>` + `+++ b/<path>` pair (unified).',
+    );
+  }
   const stripped = stripDiffPrefix(rawName);
   const norm = normalizeInputPath(stripped);
   return isAbsolute(norm) ? pathResolve(norm) : resolveAgainstCwd(norm, basePath);

package/src/runtime/agent/orchestrator/tools/patch/v4a-convert.mjs

@@ -661,6 +661,12 @@ export async function convertV4ASectionsToUnifiedPatch(sections, basePath, optio
       throw new Error(`V4A update target unreadable: ${section.path} (${err?.code || err?.message || String(err)}).`);
     }
     const sectionHunks = [];
+    // Resolved-position ordering for the emitted unified hunks: the unique-
+    // verbatim fallback in findLineSequence can resolve a later-listed hunk
+    // BEFORE an earlier one, and the native engine applies unified hunks with
+    // a forward-only cursor — emission must therefore be sorted by resolved
+    // start (stable on ties) instead of resolution order.
+    const sectionHunkEntries = [];
     const orderedHunks = orderV4AHunksByFilePosition(sourceLines, section.hunks, fuzzy);
     let nextSearchLine = 0;
     for (const hunk of orderedHunks) {
@@ -730,10 +736,18 @@ export async function convertV4ASectionsToUnifiedPatch(sections, basePath, optio
       // insertion index (`-N,0` inserts after source line N), while a real
       // replacement starts at the 1-based first replaced line.
       const oldStart = emittedOld === 0 ? loc.oldStartIdx : loc.oldStartIdx + 1;
-      sectionHunks.push(`@@ -${oldStart},${emittedOld} +${oldStart},${emittedNew} @@${tail ? ` ${tail}` : ''}`);
-      for (const bodyLine of bodyLines) sectionHunks.push(bodyLine);
+      sectionHunkEntries.push({
+        start: loc.oldStartIdx,
+        order: sectionHunkEntries.length,
+        lines: [
+          `@@ -${oldStart},${emittedOld} +${oldStart},${emittedNew} @@${tail ? ` ${tail}` : ''}`,
+          ...bodyLines,
+        ],
+      });
       nextSearchLine = loc.nextSearchLine;
     }
+    sectionHunkEntries.sort((a, b) => (a.start - b.start) || (a.order - b.order));
+    for (const entry of sectionHunkEntries) sectionHunks.push(...entry.lines);
     if (sectionHunks.length > 0) {
       out.push(`--- a/${displayPath}`);
       out.push(`+++ b/${displayPath}`);

package/src/runtime/agent/orchestrator/tools/patch-tool-defs.mjs

@@ -30,12 +30,34 @@ eof_line: "*** End of File" LF
 const APPLY_PATCH_FREEFORM_DESCRIPTION =
   'Use the `apply_patch` tool to edit files. This is a FREEFORM tool, so do not wrap the patch in JSON.';
 
+// JSON-schema fallback providers (Anthropic and other non-grammar surfaces)
+// get the full Codex V4A instructions inline: without a grammar the model has
+// no format signal beyond this description, and the dominant one-shot failure
+// modes (missing section headers, retyped context, marker resubmission) are
+// exactly what these rules preempt. Mirrors
+// refs/codex/codex-rs/prompts/templates/apply_patch_tool_instructions.md,
+// adapted to the JSON `patch` argument.
+const APPLY_PATCH_JSON_DESCRIPTION = [
+  'Primary file-editing tool. Send `patch` as soon as the target and change are known.',
+  'Use this V4A envelope:',
+  '*** Begin Patch',
+  '[file sections]',
+  '*** End Patch',
+  'Every section starts with exactly one header:',
+  '- *** Add File: <path> then one or more +content lines.',
+  '- *** Delete File: <path> with nothing after it.',
+  '- *** Update File: <path>, optionally followed by *** Move to: <new path>.',
+  'Updates contain hunks introduced by @@ or @@ <enclosing class/function>. Prefix every hunk line with space (context), - (remove), or + (add); a hunk at end of file may close with *** End of File.',
+  'Copy 3 context lines above and below verbatim from the file. Do not duplicate overlapping context. If context is not unique, add one or more enclosing @@ headers.',
+  'Use project-relative paths. Every added file line needs +. Never submit a compacted-history marker; re-read and create a fresh patch.',
+].join('\n');
+
 export const PATCH_TOOL_DEFS = [
   {
     name: 'apply_patch',
     title: 'Mixdog Apply Patch',
     annotations: { title: 'Mixdog Apply Patch', readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false, compressible: false, compressibleLossless: true },
-    description: 'Use the `apply_patch` tool to edit files.',
+    description: APPLY_PATCH_JSON_DESCRIPTION,
     freeformDescription: APPLY_PATCH_FREEFORM_DESCRIPTION,
     freeform: {
       type: 'grammar',
@@ -45,7 +67,7 @@ export const PATCH_TOOL_DEFS = [
     inputSchema: {
       type: 'object',
       properties: {
-        patch: { type: 'string', description: 'The V4A patch text to apply.' },
+        patch: { type: 'string', description: 'The V4A patch text to apply (format and context rules in the tool description).' },
       },
       required: ['patch'],
     },

package/src/runtime/shared/child-guardian.mjs

@@ -38,6 +38,7 @@ function guardianScript({
   orphanGraceMs,
   forceGraceMs,
   minFreeMemoryMb,
+  receiptPath,
 }) {
   return `
 const { spawnSync } = require('node:child_process');
@@ -50,6 +51,22 @@ const pollMs = ${JSON.stringify(pollMs)};
 const orphanGraceMs = ${JSON.stringify(orphanGraceMs)};
 const forceGraceMs = ${JSON.stringify(forceGraceMs)};
 const minFreeMemoryBytes = ${JSON.stringify(minFreeMemoryMb * 1024 * 1024)};
+const receiptPath = ${JSON.stringify(receiptPath || null)};
+// Kill receipt: guardian kills are otherwise indistinguishable from a crashed
+// wrapper ("process exited without reporting an exit code"). Written BEFORE
+// the kill so the owner's next status refresh can attribute the death.
+function writeReceipt(reason, extra) {
+  if (!receiptPath) return;
+  try {
+    require('node:fs').writeFileSync(receiptPath, JSON.stringify({
+      reason,
+      at: new Date().toISOString(),
+      guardianPid: process.pid,
+      childPid,
+      ...extra,
+    }));
+  } catch {}
+}
 function alive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
   try { process.kill(pid, 0); return true; }
@@ -84,6 +101,7 @@ const timer = setInterval(() => {
     try { freeBytes = Number(freemem()); } catch {}
     if (Number.isFinite(freeBytes) && freeBytes < minFreeMemoryBytes) {
       killing = true;
+      writeReceipt('host-memory-floor', { freeBytes, minFreeMemoryBytes });
       killTarget(true);
       process.exit(0);
     }
@@ -98,6 +116,7 @@ const timer = setInterval(() => {
   if (!orphanedAt) orphanedAt = Date.now();
   if (killing || Date.now() - orphanedAt < orphanGraceMs) return;
   killing = true;
+  writeReceipt('parent-exit', {});
   killTarget(false);
   setTimeout(() => { if (alive(childPid)) killTarget(true); process.exit(0); }, forceGraceMs).unref?.();
 }, pollMs);
@@ -115,6 +134,7 @@ export function startChildGuardian({
   forceGraceMs = graceMs,
   protectHostMemory = false,
   minFreeMemoryMb = protectHostMemory ? childGuardianMemoryFloorMb() : 0,
+  receiptPath = null,
 } = {}) {
   const parent = positiveInt(parentPid);
   const child = positiveInt(childPid);
@@ -134,6 +154,7 @@ export function startChildGuardian({
         orphanGraceMs: Math.max(100, Math.floor(Number(orphanGraceMs) || Number(graceMs) || 3000)),
         forceGraceMs: Math.max(100, Math.floor(Number(forceGraceMs) || Number(graceMs) || 3000)),
         minFreeMemoryMb: memoryFloorMb,
+        receiptPath: typeof receiptPath === 'string' && receiptPath ? receiptPath : null,
       }),
     ], {
       stdio: 'ignore',

package/src/standalone/explore-tool.mjs

@@ -18,7 +18,7 @@ export const EXPLORE_TOOL = {
   name: 'explore',
   title: 'Explore',
   annotations: { title: 'Explore', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
-  description: 'Locator for broad/uncertain targets with no known path, repo or machine-wide (dot dirs included). Array = independent targets: query[] fans out facets (max 8), never rephrasings. Every returned path:line freezes the LOCATION only; read/code_graph detail inspection is valid when content was not returned; never re-locate it — search only unresolved facets.',
+  description: 'Locator for broad/uncertain targets with no known path, repo or machine-wide (dot dirs included). Array = independent targets: query[] fans out facets (max 8), never rephrasings.',
   inputSchema: {
     type: 'object',
     properties: {

package/src/tui/app/route-pickers.mjs

@@ -157,134 +157,28 @@ export function createRoutePickers({
     closeUsagePanel();
     setPicker({
       title: 'Workflow',
-      description: 'Active workflow and its agents.',
-      help: returnTo ? '↑/↓ Select · Enter Open · Esc Settings' : '↑/↓ Select · Enter Open · Esc Back',
+      description: 'Select active workflow.',
+      help: returnTo ? '↑/↓ Select · Enter Choose · Esc Settings' : '↑/↓ Select · Enter Choose · Esc Back',
       labelWidth: 18,
-      initialIndex: Math.max(0, items.findIndex((item) => item.value === (options.initialWorkflowId || ''))),
       items,
       onSelect: (_value, item) => {
         const workflow = item?._workflow;
         if (!workflow) return;
-        // Depth mirrors the system model: a workflow pack owns the agent set
-        // it delegates to, so Enter opens the pack (activate + its agents)
-        // instead of switching immediately.
-        openWorkflowDetailPicker(workflow.id, { returnTo });
-      },
-      onCancel: () => {
         setPicker(null);
-        if (returnTo) returnTo();
-      },
-    });
-  };
-
-  // Workflow detail: activation row plus the agents this pack delegates to
-  // (route editing inline). Packs without an `agents:` key delegate to all
-  // fixed agents; a configured-but-empty list means Lead works alone.
-  const openWorkflowDetailPicker = (workflowId, options = {}) => {
-    const returnTo = typeof options.returnTo === 'function' ? options.returnTo : null;
-    let workflows = [];
-    try {
-      workflows = store.listWorkflows?.() || [];
-    } catch (e) {
-      store.pushNotice(`could not list workflows: ${e?.message || e}`, 'error');
-      return;
-    }
-    const workflow = workflows.find((item) => item.id === workflowId);
-    if (!workflow) {
-      store.pushNotice(`workflow "${workflowId}" not found`, 'warn');
-      openWorkflowPicker({ returnTo });
-      return;
-    }
-    let agents = [];
-    try {
-      agents = store.listAgents?.() || [];
-    } catch (e) {
-      store.pushNotice(`could not list agents: ${e?.message || e}`, 'error');
-      agents = [];
-    }
-    const packAgents = workflow.agentsConfigured === true
-      ? (workflow.agents || [])
-          .map((id) => agents.find((agent) => agent.id === id) || { id, label: id, route: null, description: '' })
-      : agents.filter((agent) => agent.custom !== true);
-    const routeOverrides = options.routeOverrides && typeof options.routeOverrides === 'object' ? options.routeOverrides : {};
-    const items = [
-      {
-        value: '__activate',
-        label: workflow.active ? 'Active' : 'Activate',
-        marker: workflow.active ? '✓' : '',
-        markerColor: theme.success,
-        description: workflow.active
-          ? 'This workflow is active.'
-          : 'Make this the active workflow.',
-      },
-      ...(packAgents.length
-        ? packAgents.map((agent) => ({
-            value: agent.id,
-            label: agent.label,
-            metaParts: agentModelParts(routeOverrides[agent.id] || agent.route),
-            description: agent.description || agent.definition?.description || '',
-            _agent: agent,
-          }))
-        : [{
-            value: '__lead-only',
-            label: 'Lead only',
-            description: 'This workflow delegates to no agents.',
-          }]),
-    ];
-    setPicker({
-      title: workflow.name,
-      description: workflow.description || 'Workflow activation and agents.',
-      help: '↑/↓ Select · Enter Choose · Esc Back',
-      indexMode: 'always',
-      labelWidth: 18,
-      metaWidth: 33,
-      initialIndex: Math.max(0, items.findIndex((item) => item.value === (options.initialValue || '__activate'))),
-      items,
-      onSelect: (_value, item) => {
-        if (item?.value === '__activate') {
-          if (workflow.active) {
-            store.pushNotice(`${workflow.name} is already the active workflow`, 'info');
-            return;
-          }
-          setPicker(null);
-          void store.setWorkflow?.(workflow.id)
-            .then((result) => {
-              if (!result) {
-                store.pushNotice('Workflow switch is already running.', 'warn');
-                return;
-              }
-              store.pushNotice(workflowSwitchNotice(result), 'info');
-              openWorkflowPicker({ returnTo, initialWorkflowId: workflow.id });
-            })
-            .catch((e) => store.pushNotice(`Couldn’t switch workflow: ${e?.message || e}`, 'error'));
-          return;
-        }
-        const agent = item?._agent;
-        if (!agent) return;
-        void openModelPicker({
-          title: `${agent.label} Model`,
-          providerDescription: 'Choose a provider for this agent.',
-          currentRoute: agent.route || null,
-          returnTo: () => openWorkflowDetailPicker(workflow.id, { returnTo, initialValue: agent.id }),
-          onImmediateSelect: (routeInput) => {
-            openWorkflowDetailPicker(workflow.id, {
-              returnTo,
-              routeOverrides: { [agent.id]: routeInput },
-              initialValue: agent.id,
-            });
-          },
-          onSelectRoute: async (routeInput) => {
-            const result = await store.setAgentRoute?.(agent.id, routeInput);
+        void store.setWorkflow?.(workflow.id)
+          .then((result) => {
             if (!result) {
-              store.pushNotice('Agent model save is already running.', 'warn');
+              store.pushNotice('Workflow switch is already running.', 'warn');
               return;
             }
-            store.pushNotice(`${agent.label} model set to ${agentModelProfile(result)}`, 'info');
-          },
-        });
+            store.pushNotice(workflowSwitchNotice(result), 'info');
+            if (returnTo) returnTo();
+          })
+          .catch((e) => store.pushNotice(`Couldn’t switch workflow: ${e?.message || e}`, 'error'));
       },
       onCancel: () => {
-        openWorkflowPicker({ returnTo, initialWorkflowId: workflow.id });
+        setPicker(null);
+        if (returnTo) returnTo();
       },
     });
   };

package/src/tui/dist/index.mjs

@@ -21142,118 +21142,26 @@ function createRoutePickers({
     closeUsagePanel();
     setPicker({
       title: "Workflow",
-      description: "Active workflow and its agents.",
-      help: returnTo ? "\u2191/\u2193 Select \xB7 Enter Open \xB7 Esc Settings" : "\u2191/\u2193 Select \xB7 Enter Open \xB7 Esc Back",
+      description: "Select active workflow.",
+      help: returnTo ? "\u2191/\u2193 Select \xB7 Enter Choose \xB7 Esc Settings" : "\u2191/\u2193 Select \xB7 Enter Choose \xB7 Esc Back",
       labelWidth: 18,
-      initialIndex: Math.max(0, items.findIndex((item) => item.value === (options.initialWorkflowId || ""))),
       items,
       onSelect: (_value, item) => {
         const workflow = item?._workflow;
         if (!workflow) return;
-        openWorkflowDetailPicker(workflow.id, { returnTo });
-      },
-      onCancel: () => {
         setPicker(null);
-        if (returnTo) returnTo();
-      }
-    });
-  };
-  const openWorkflowDetailPicker = (workflowId, options = {}) => {
-    const returnTo = typeof options.returnTo === "function" ? options.returnTo : null;
-    let workflows = [];
-    try {
-      workflows = store.listWorkflows?.() || [];
-    } catch (e) {
-      store.pushNotice(`could not list workflows: ${e?.message || e}`, "error");
-      return;
-    }
-    const workflow = workflows.find((item) => item.id === workflowId);
-    if (!workflow) {
-      store.pushNotice(`workflow "${workflowId}" not found`, "warn");
-      openWorkflowPicker({ returnTo });
-      return;
-    }
-    let agents = [];
-    try {
-      agents = store.listAgents?.() || [];
-    } catch (e) {
-      store.pushNotice(`could not list agents: ${e?.message || e}`, "error");
-      agents = [];
-    }
-    const packAgents = workflow.agentsConfigured === true ? (workflow.agents || []).map((id) => agents.find((agent) => agent.id === id) || { id, label: id, route: null, description: "" }) : agents.filter((agent) => agent.custom !== true);
-    const routeOverrides = options.routeOverrides && typeof options.routeOverrides === "object" ? options.routeOverrides : {};
-    const items = [
-      {
-        value: "__activate",
-        label: workflow.active ? "Active" : "Activate",
-        marker: workflow.active ? "\u2713" : "",
-        markerColor: theme.success,
-        description: workflow.active ? "This workflow is active." : "Make this the active workflow."
-      },
-      ...packAgents.length ? packAgents.map((agent) => ({
-        value: agent.id,
-        label: agent.label,
-        metaParts: agentModelParts2(routeOverrides[agent.id] || agent.route),
-        description: agent.description || agent.definition?.description || "",
-        _agent: agent
-      })) : [{
-        value: "__lead-only",
-        label: "Lead only",
-        description: "This workflow delegates to no agents."
-      }]
-    ];
-    setPicker({
-      title: workflow.name,
-      description: workflow.description || "Workflow activation and agents.",
-      help: "\u2191/\u2193 Select \xB7 Enter Choose \xB7 Esc Back",
-      indexMode: "always",
-      labelWidth: 18,
-      metaWidth: 33,
-      initialIndex: Math.max(0, items.findIndex((item) => item.value === (options.initialValue || "__activate"))),
-      items,
-      onSelect: (_value, item) => {
-        if (item?.value === "__activate") {
-          if (workflow.active) {
-            store.pushNotice(`${workflow.name} is already the active workflow`, "info");
+        void store.setWorkflow?.(workflow.id).then((result) => {
+          if (!result) {
+            store.pushNotice("Workflow switch is already running.", "warn");
             return;
           }
-          setPicker(null);
-          void store.setWorkflow?.(workflow.id).then((result) => {
-            if (!result) {
-              store.pushNotice("Workflow switch is already running.", "warn");
-              return;
-            }
-            store.pushNotice(workflowSwitchNotice2(result), "info");
-            openWorkflowPicker({ returnTo, initialWorkflowId: workflow.id });
-          }).catch((e) => store.pushNotice(`Couldn\u2019t switch workflow: ${e?.message || e}`, "error"));
-          return;
-        }
-        const agent = item?._agent;
-        if (!agent) return;
-        void openModelPicker({
-          title: `${agent.label} Model`,
-          providerDescription: "Choose a provider for this agent.",
-          currentRoute: agent.route || null,
-          returnTo: () => openWorkflowDetailPicker(workflow.id, { returnTo, initialValue: agent.id }),
-          onImmediateSelect: (routeInput) => {
-            openWorkflowDetailPicker(workflow.id, {
-              returnTo,
-              routeOverrides: { [agent.id]: routeInput },
-              initialValue: agent.id
-            });
-          },
-          onSelectRoute: async (routeInput) => {
-            const result = await store.setAgentRoute?.(agent.id, routeInput);
-            if (!result) {
-              store.pushNotice("Agent model save is already running.", "warn");
-              return;
-            }
-            store.pushNotice(`${agent.label} model set to ${agentModelProfile2(result)}`, "info");
-          }
-        });
+          store.pushNotice(workflowSwitchNotice2(result), "info");
+          if (returnTo) returnTo();
+        }).catch((e) => store.pushNotice(`Couldn\u2019t switch workflow: ${e?.message || e}`, "error"));
       },
       onCancel: () => {
-        openWorkflowPicker({ returnTo, initialWorkflowId: workflow.id });
+        setPicker(null);
+        if (returnTo) returnTo();
       }
     });
   };

package/src/workflows/solo/WORKFLOW.md

@@ -15,9 +15,11 @@ changed request resets planning; a scope change requires fresh approval.
 On approval, Lead executes all work itself — never spawn, send, or delegate
 to agents. Complete in-scope fixes without reapproval.
 
-Verify directly: check and fix until clean, or report the blocker.
+Verification is single-pass: run the one check that most directly proves the
+deliverable exactly once; a pass is final. Iterate only on a failing check,
+re-running just that check after each fix, or report the blocker.
 
-Report the verified result against the approved plan. Build, deploy, commit,
+Report the result and its proving check against the approved plan. Build, deploy, commit,
 and push happen only on an explicit user request.
 
 On direction change, pause and re-consult the user.