mixdog 0.9.91 → 0.9.93

package/src/runtime/agent/orchestrator/tools/lib/pwsh-standby-pool.mjs

@@ -48,18 +48,22 @@ const EXPECTED_ARGS = Object.freeze(['-NoLogo', '-NoProfile', '-NonInteractive',
 // with the same `$?`→0/1 exit mapping pwsh -Command applies implicitly, then
 // emits `<<<MIXDOG_DONE_<nonce>:<code>>>>` on stdout and
 // `<<<MIXDOG_DONE_<nonce>>>>` on stderr (both streams provably drained).
-// Each command pipes through Microsoft.PowerShell.Core\Out-Default: the whole
-// marker loop is ONE top-level pipeline, so without an explicit per-command
-// formatting terminator Format-Table kept object output buffered PAST the done
-// sentinel and captures came back empty (`Get-ChildItem | Select-Object` →
-// no output). The per-command Out-Default flushes formatted output before the
-// sentinel is written, restoring one-shot `pwsh -Command` parity.
+// Each command renders through Out-String -Stream and writes lines straight
+// to [Console]::Out: host-side Out-Default table rendering proved ASYNC in
+// long-lived standbys — formatted object output could flush AFTER the done
+// sentinel (whole tables lost from the capture, then surfacing as stale
+// bytes at the head of the NEXT command's capture). Rendering inside the
+// pipeline and emitting via the SAME Console writer as the sentinel makes
+// the ordering structural: every success-stream byte is on stdout before the
+// sentinel line. Verified empirically: table shape/blank lines, long lines
+// (no 120-col wrap), Write-Error rendering, and the `$?` exit mapping all
+// match one-shot `pwsh -Command`.
 // stdin EOF exits the process with the LAST command's code — that is exactly
 // what background-promotion relies on for its exit-file. A user script that
 // calls `exit N` terminates the whole process with N (identical code to the
 // one-shot path); the caller settles via 'close' and the entry is discarded.
 function _standbyBootScript(nonce) {
-    const runSentinel = `<<<MIXDOG_RUN_${nonce}>>>`;
+    const runPrefix = `<<<MIXDOG_RUN_${nonce}:`;
     const donePrefix = `<<<MIXDOG_DONE_${nonce}`;
     return [
         '$null = & {0}',
@@ -86,10 +90,15 @@ function _standbyBootScript(nonce) {
         '$__code = 0',
         'while ($true) {',
         '  $__buf = New-Object System.Text.StringBuilder',
+        "  $__tok = ''",
         '  while ($true) {',
         '    $__line = $__sr.ReadLine()',
         '    if ($null -eq $__line) { exit $__code }',
-        `    if ($__line -eq '${runSentinel}') { break }`,
+        // Per-COMMAND token: the RUN line carries a fresh token minted at
+        // take() time; DONE markers echo it back. A stale DONE from an
+        // earlier command on this entry can therefore NEVER match the
+        // current command's marker prefix (same-nonce offset hardening).
+        `    if ($__line.StartsWith('${runPrefix}') -and $__line.EndsWith('>>>')) { $__tok = $__line.Substring(${runPrefix.length}, $__line.Length - ${runPrefix.length} - 3); break }`,
         '    [void]$__buf.AppendLine($__line)',
         '  }',
         '  foreach ($__n in @(Get-ChildItem env: | ForEach-Object Name)) { if (-not $__baseEnv.ContainsKey($__n)) { Remove-Item ("env:$__n") -ErrorAction SilentlyContinue } }',
@@ -108,7 +117,7 @@ function _standbyBootScript(nonce) {
         '  $global:__MIXDOG_RC = 1',
         '  try {',
         "    $__sc = [ScriptBlock]::Create($__buf.ToString() + [Environment]::NewLine + 'if ($?) { $global:__MIXDOG_RC = 0 } else { $global:__MIXDOG_RC = 1 }')",
-'    & $__sc | Microsoft.PowerShell.Core\\Out-Default',
+'    & $__sc | Microsoft.PowerShell.Utility\\Out-String -Stream | Microsoft.PowerShell.Core\\ForEach-Object { [Console]::Out.WriteLine($_) }',
         '  } catch {',
         '    $global:__MIXDOG_RC = 1',
         "    [Console]::Error.WriteLine('Exception: ' + $_.Exception.Message)",
@@ -116,8 +125,8 @@ function _standbyBootScript(nonce) {
         '  $__code = $global:__MIXDOG_RC',
         '  [Console]::Out.Flush()',
         '  [Console]::Error.Flush()',
-        `  [Console]::Out.WriteLine('${donePrefix}:' + $__code + '>>>')`,
-        `  [Console]::Error.WriteLine('${donePrefix}>>>')`,
+        `  [Console]::Out.WriteLine('${donePrefix}:' + $__tok + ':' + $__code + '>>>')`,
+        `  [Console]::Error.WriteLine('${donePrefix}:' + $__tok + '>>>')`,
         '}',
     ].join('\n');
 }
@@ -227,11 +236,19 @@ export function takePwshStandby({ shell, shellArgs, env }) {
         entry.child.stderr?.ref?.();
     } catch { /* best-effort */ }
     _topUp(shell, env, sig);
+    // Fresh token per command: DONE markers are only valid when they echo
+    // this token, so any straggler marker from a previous command on the
+    // same entry (same nonce) is inert for this capture.
+    const runToken = randomBytes(6).toString('hex');
     return {
         child: entry.child,
         nonce: entry.nonce,
-        runSentinel: `<<<MIXDOG_RUN_${entry.nonce}>>>`,
-        doneMarkerPrefix: `<<<MIXDOG_DONE_${entry.nonce}`,
+        runSentinel: `<<<MIXDOG_RUN_${entry.nonce}:${runToken}>>>`,
+        doneMarkerPrefix: `<<<MIXDOG_DONE_${entry.nonce}:${runToken}`,
+        // Entry-scoped prefix: lines matching this but NOT doneMarkerPrefix
+        // are stale markers from an earlier command — the caller drops them
+        // from the capture instead of surfacing sentinel noise.
+        staleMarkerPrefix: `<<<MIXDOG_DONE_${entry.nonce}`,
         run(spawnCommand, cwdForRun) {
             const esc = String(cwdForRun || '').replace(/'/g, "''");
             const prelude = esc
@@ -240,7 +257,7 @@ export function takePwshStandby({ shell, shellArgs, env }) {
             try {
                 const body = prelude + String(spawnCommand ?? '');
                 entry.child.stdin.write(body.endsWith('\n') ? body : `${body}\n`, 'utf8');
-                entry.child.stdin.write(`<<<MIXDOG_RUN_${entry.nonce}>>>\n`, 'utf8');
+                entry.child.stdin.write(`<<<MIXDOG_RUN_${entry.nonce}:${runToken}>>>\n`, 'utf8');
                 return true;
             } catch {
                 // Feed failed (child died in the take→run window): kill so the
@@ -276,6 +293,22 @@ export function takePwshStandby({ shell, shellArgs, env }) {
                 _killEntry(entry);
                 return false;
             }
+            // Drain bytes a previous command left in the paused streams (late
+            // flushes that raced past the caller's detach). Without this they
+            // would surface at the HEAD of the next command's capture.
+            // Diagnostic (2026-08-04, intermittent empty-capture reports in a
+            // long-lived host): any stale byte seen here PROVES output escaped
+            // a finished command's capture on this entry — the exact precursor
+            // of a same-nonce marker offset corrupting the NEXT command. Rare
+            // by construction, so the log is always-on and one line.
+            let _staleBytes = 0;
+            try { let b; while ((b = c.stdout.read()) !== null) { _staleBytes += b.length; } } catch { /* best-effort */ }
+            try { let b; while ((b = c.stderr.read()) !== null) { _staleBytes += b.length; } } catch { /* best-effort */ }
+            if (_staleBytes > 0) {
+                try {
+                    process.stderr.write(`[pwsh-standby] recycle drained ${_staleBytes}B stale output (pid=${c.pid}) — late flush escaped the previous command's capture\n`);
+                } catch { /* diagnostics only */ }
+            }
             entry.taken = false;
             entry.consumed = false;
             entry.spawnedAt = Date.now() - STANDBY_READY_AGE_MS;

package/src/runtime/agent/orchestrator/tools/patch/v4a-convert.mjs

@@ -208,6 +208,70 @@ function findContextTolerantWindow(sourceLines, oldLines, oldTags) {
   return windows.length === 1 ? { start: windows[0] } : null;
 }
 
+// Last-resort recovery for a model that accidentally copied 1-2 unrelated
+// unchanged context lines just outside the real edit. Trim only contiguous
+// outer ' ' lines — never '-' or '+' lines — and accept the shortened old
+// block only when it matches byte-exactly at exactly one place in the ENTIRE
+// file. Requiring a deletion keeps this fallback off insertion-only hunks;
+// exact whole-block matching proves every deletion line is current. Any
+// competing trim plan or duplicate occurrence is ambiguous and stays a hard
+// context miss.
+function findOuterContextTrimmedWindow(sourceLines, hunk, stats) {
+  const body = (hunk?.lines || []).filter(
+    (line) => typeof line === 'string'
+      && line.length > 0
+      && !isV4AEndOfFileMarker(line)
+      && (line[0] === ' ' || line[0] === '-' || line[0] === '+'),
+  );
+  if (!body.some((line) => line[0] === '-')) return null;
+
+  let leadingAvailable = 0;
+  while (leadingAvailable < body.length && body[leadingAvailable][0] === ' ') leadingAvailable++;
+  let trailingAvailable = 0;
+  while (
+    trailingAvailable < body.length - leadingAvailable
+    && body[body.length - 1 - trailingAvailable][0] === ' '
+  ) trailingAvailable++;
+  if (leadingAvailable === 0 && trailingAvailable === 0) return null;
+
+  for (let totalTrimmed = 1; totalTrimmed <= 2; totalTrimmed++) {
+    const plans = [];
+    let ambiguous = false;
+    for (let leading = 0; leading <= Math.min(totalTrimmed, leadingAvailable); leading++) {
+      const trailing = totalTrimmed - leading;
+      if (trailing > trailingAvailable) continue;
+      const remainingBody = body.slice(leading, body.length - trailing);
+      if (!remainingBody.some((line) => line[0] === '-')) continue;
+      const oldLines = stats.oldLines.slice(leading, stats.oldLines.length - trailing);
+      const newLines = stats.newLines.slice(leading, stats.newLines.length - trailing);
+      if (oldLines.length === 0) continue;
+
+      const starts = [];
+      outer: for (let i = 0; i + oldLines.length <= sourceLines.length; i++) {
+        for (let k = 0; k < oldLines.length; k++) {
+          if (sourceLines[i + k] !== oldLines[k]) continue outer;
+        }
+        starts.push(i);
+        if (starts.length > 1) break;
+      }
+      if (starts.length > 1) {
+        ambiguous = true;
+      } else if (starts.length === 1) {
+        plans.push({
+          start: starts[0],
+          oldLines,
+          newLines,
+          leading,
+          trailing,
+        });
+      }
+    }
+    if (ambiguous || plans.length > 1) return null;
+    if (plans.length === 1) return plans[0];
+  }
+  return null;
+}
+
 function resolveV4AHunkPosition(sourceLines, hunk, nextSearchLine, options = {}) {
   const stats = v4AHunkLineStats(hunk);
   if (stats.oldCount === 0 && stats.newCount === 0) return { skip: true };
@@ -223,6 +287,8 @@ function resolveV4AHunkPosition(sourceLines, hunk, nextSearchLine, options = {})
   let oldStartIdx;
   let trimmedTrailing = 0;
   let trimmedTrailingNew = 0;
+  let trimmedLeadingContext = 0;
+  let trimmedTrailingContext = 0;
   if (stats.oldCount === 0) {
     oldStartIdx = eofInsertionIndex(sourceLines);
   } else {
@@ -313,6 +379,20 @@ function resolveV4AHunkPosition(sourceLines, hunk, nextSearchLine, options = {})
       }
     }
   }
+  // A stray copied line outside the edit should not cost a failed tool turn.
+  // This fallback is deliberately narrower than the context-tolerance tier:
+  // fuzzy mode only, non-EOF, no newline-sentinel interaction, deletion hunks
+  // only, byte-exact remaining block, and one unique whole-file location.
+  if (oldStartIdx < 0 && fuzzy && !eof && trimmedTrailing === 0) {
+    const trimmed = findOuterContextTrimmedWindow(sourceLines, hunk, stats);
+    if (trimmed) {
+      oldStartIdx = trimmed.start;
+      oldLinesPattern = trimmed.oldLines;
+      newLinesPattern = trimmed.newLines;
+      trimmedLeadingContext = trimmed.leading;
+      trimmedTrailingContext = trimmed.trailing;
+    }
+  }
   if (oldStartIdx < 0) {
     const msg = `V4A hunk context not found: ${formatV4AHunkLocator(hunk)};${formatV4AContextMissHint(sourceLines, stats, anchorLine)}`;
     return { error: msg };
@@ -329,6 +409,8 @@ function resolveV4AHunkPosition(sourceLines, hunk, nextSearchLine, options = {})
     nextSearchLine: matchLen === 0 ? Math.max(0, nextSearchLine || 0) : oldStartIdx + matchLen,
     trimmedTrailing,
     trimmedTrailingNew,
+    trimmedLeadingContext,
+    trimmedTrailingContext,
   };
 }
 
@@ -764,6 +846,23 @@ export async function convertV4ASectionsToUnifiedPatch(sections, basePath, optio
           if (dropOldAt >= 0 && (!loc.trimmedTrailingNew || dropNewAt >= 0)) break;
         }
       }
+      const droppedOuterContext = new Set();
+      let leadingToDrop = loc.trimmedLeadingContext || 0;
+      for (let i = 0; i < hunk.lines.length && leadingToDrop > 0; i++) {
+        const line = hunk.lines[i];
+        if (isV4AEndOfFileMarker(line)) continue;
+        if (!line || line[0] !== ' ') break;
+        droppedOuterContext.add(i);
+        leadingToDrop--;
+      }
+      let trailingToDrop = loc.trimmedTrailingContext || 0;
+      for (let i = hunk.lines.length - 1; i >= 0 && trailingToDrop > 0; i--) {
+        const line = hunk.lines[i];
+        if (isV4AEndOfFileMarker(line)) continue;
+        if (!line || line[0] !== ' ') break;
+        droppedOuterContext.add(i);
+        trailingToDrop--;
+      }
       // Emit the body FIRST and derive the header counts from what was
       // actually emitted: the trailing-newline sentinel drop can remove a line
       // from one side only, so a header computed from the raw hunk stats can
@@ -775,6 +874,7 @@ export async function convertV4ASectionsToUnifiedPatch(sections, basePath, optio
       const srcEnd = loc.oldStartIdx + loc.matchLen;
       for (let i = 0; i < hunk.lines.length; i++) {
         const line = hunk.lines[i];
+        if (droppedOuterContext.has(i)) continue;
         if (isV4AEndOfFileMarker(line)) continue;
         const prefix = line[0];
         if (prefix === ' ' || prefix === '-') {

package/src/runtime/agent/orchestrator/tools/patch-tool-defs.mjs

@@ -38,17 +38,16 @@ const APPLY_PATCH_FREEFORM_DESCRIPTION =
 // refs/codex/codex-rs/prompts/templates/apply_patch_tool_instructions.md,
 // adapted to the JSON `patch` argument.
 const APPLY_PATCH_JSON_DESCRIPTION = [
-  'Primary file-editing tool. Send `patch` as soon as the target and change are known.',
-  'Use this V4A envelope:',
+  'Edit files with this V4A envelope:',
   '*** Begin Patch',
   '[file sections]',
   '*** End Patch',
   'Every section starts with exactly one header:',
-  '- *** Add File: <path> then one or more +content lines.',
+  '- *** Add File: <path> then +content lines.',
   '- *** Delete File: <path> with nothing after it.',
   '- *** Update File: <path>, optionally followed by *** Move to: <new path>.',
-  'Updates contain hunks introduced by @@ or @@ <enclosing class/function>. Prefix every hunk line with space (context), - (remove), or + (add); a hunk at end of file may close with *** End of File.',
-  'Copy 3 context lines above and below verbatim from the newest tool output of the file (never retype from memory; after your own patch, use post-patch content). Do not duplicate overlapping context. If context is not unique, add one or more enclosing @@ headers.',
+  'Update hunks open with @@ or @@ <enclosing class/function>; prefix every line with space (context), - (remove), or + (add); a hunk at end of file may close with *** End of File.',
+  'Copy 3 context lines above and below verbatim from the newest tool output of the file (after your own patch, use post-patch content; never retype from memory). Do not duplicate overlapping context; if context is not unique, add enclosing @@ headers.',
   'Use project-relative paths. Every added file line needs +. Never submit a compacted-history marker; re-read and create a fresh patch.',
 ].join('\n');
 
@@ -68,8 +67,10 @@ export const PATCH_TOOL_DEFS = [
       type: 'object',
       properties: {
         patch: { type: 'string', description: 'The V4A patch text to apply (format and context rules in the tool description).' },
+        post_shell: { type: 'string', description: 'Verification command run when the patch applies; skipped on patch failure.' },
       },
       required: ['patch'],
+      additionalProperties: false,
     },
   },
 ];

package/src/runtime/agent/orchestrator/tools/shell-command.mjs

@@ -492,6 +492,7 @@ export function execShellCommand({
     let _stderrData = (chunk) => taskOutput.writeStderr(chunk);
     if (_standby) {
       const donePrefix = _standby.doneMarkerPrefix;
+      const stalePrefix = _standby.staleMarkerPrefix;
       const _mk = { outDone: false, errDone: false, code: 1 };
       const tryComplete = () => {
         if (!_mk.outDone || !_mk.errDone) return;
@@ -515,6 +516,14 @@ export function execShellCommand({
               const line = tail.slice(0, idx + 1);
               tail = tail.slice(idx + 1);
               if (line.startsWith(donePrefix)) { onMarkerLine(line); continue; }
+              // Same-nonce marker with a DIFFERENT run token: a straggler
+              // from an earlier command on this standby entry. Drop it from
+              // the capture and log — this is the observable trace of the
+              // late-flush/offset condition the per-command token defuses.
+              if (stalePrefix && line.startsWith(stalePrefix)) {
+                try { process.stderr.write(`[pwsh-standby] dropped stale marker from a previous command (pid=${child.pid})\n`); } catch { /* diagnostics only */ }
+                continue;
+              }
               out += line;
             }
             if (out) write(out);

package/src/runtime/agent/orchestrator/tools/shell-state.mjs

@@ -9,7 +9,7 @@
 // Style mirrors shell-snapshot.mjs: files live under getPluginData(), one file
 // per session key, with a stale-file sweep on module init.
 
-import { existsSync, mkdirSync, readFileSync, statSync, utimesSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, statSync, unlinkSync, utimesSync, writeFileSync } from 'node:fs';
 import { readdir as readdirAsync, stat as statAsync, unlink as unlinkAsync } from 'node:fs/promises';
 import { join } from 'node:path';
 import { createHash } from 'node:crypto';
@@ -30,6 +30,10 @@ function _stateFileFor(sessionKey) {
     return join(_stateDir(), `cwd-${_keyFor(sessionKey)}.txt`);
 }
 
+function _probeFileFor(sessionKey, probeId) {
+    return join(_stateDir(), `cwd-${_keyFor(sessionKey)}.probe-${_keyFor(probeId)}.txt`);
+}
+
 // Stale-file sweep on module init. Mirrors shell-snapshot's _sweepStaleSnapshots:
 // state files older than the cutoff belong to sessions that are long gone.
 const STATE_STALE_MS = 24 * 60 * 60 * 1000;
@@ -80,10 +84,13 @@ export function resolveSessionCwd(sessionKey, explicitCwd, defaultCwd) {
 // OR when there is no nonblank session key — without a real key all callers
 // would collapse onto a single shared `__default__` file and cross-contaminate
 // each other's cwd, so we skip carry-over entirely in that case.
-export function stateFilePath(sessionKey) {
+export function stateFilePath(sessionKey, probeId = null) {
     if (sessionKey == null || String(sessionKey).trim() === '') return null;
     const dir = _stateDir();
     try { mkdirSync(dir, { recursive: true }); } catch { return null; }
+    if (probeId != null && String(probeId).trim() !== '') {
+        return _probeFileFor(sessionKey, probeId);
+    }
     const file = _stateFileFor(sessionKey);
     // Refresh mtime on every write so an old-but-live session file is not
     // reaped by the stale sweep mid-session. `touch`-equivalent: bump atime/
@@ -98,6 +105,29 @@ export function stateFilePath(sessionKey) {
     return file;
 }
 
+// A parallel shell-only batch starts every call from the same cwd snapshot.
+// Each call writes its final cwd to a private probe file; the serial batch
+// result collector commits those probes in model call order, making the final
+// carried cwd deterministic and avoiding concurrent writes to one Windows
+// Out-File target.
+export function commitSessionCwdProbe(sessionKey, probeId) {
+    if (sessionKey == null || String(sessionKey).trim() === '') return false;
+    if (probeId == null || String(probeId).trim() === '') return false;
+    const probe = _probeFileFor(sessionKey, probeId);
+    try {
+        if (!existsSync(probe)) return false;
+        const stored = readFileSync(probe, 'utf-8').trim();
+        if (!stored || !statSync(stored).isDirectory()) return false;
+        mkdirSync(_stateDir(), { recursive: true });
+        writeFileSync(_stateFileFor(sessionKey), `${stored}\n`, 'utf-8');
+        return true;
+    } catch {
+        return false;
+    } finally {
+        try { unlinkSync(probe); } catch {}
+    }
+}
+
 // PowerShell single-quote escape ('' escapes a literal quote inside '...').
 function _psQuote(s) {
     return `'${String(s).replace(/'/g, "''")}'`;

package/src/runtime/channels/backends/discord-gateway.mjs

@@ -86,18 +86,6 @@ function registerEventListeners(self) {
         } catch {}
         return;
       }
-      if (interaction.isChatInputCommand() && interaction.commandName === "stop") {
-        await interaction.reply({ content: "\u23F9 Stopping...", ephemeral: true });
-        if (self.onInteraction) {
-          self.onInteraction({
-            type: "button",
-            customId: "stop_task",
-            userId: interaction.user.id,
-            channelId: interaction.channelId ?? ""
-          });
-        }
-        return;
-      }
       if (interaction.isModalSubmit()) {
         if (self.onInteraction) {
           const fields = {};
@@ -154,31 +142,17 @@ function registerSlashCommands(self) {
     process.stderr.write(`mixdog discord: gateway connected as ${c.user.tag}
 `);
     try {
-      // Plugin registers no global commands; clear the global slot so any
-      // pre-existing entry from prior installs is not surfaced to users.
+      // Mixdog registers NO application commands. Clear the global slot and
+      // every guild's set so entries from prior installs (including the old
+      // /stop) disappear from the Discord UI.
       await c.application?.commands.set([]);
-      process.stderr.write(`mixdog discord: global application commands cleared
-`);
-
-      // Replace each guild's command set with just /stop. set() overwrites,
-      // so the desired set is the only one that survives.
-      const desiredCommands = [
-        { name: "stop", description: "Stop the current Mixdog response" },
-      ];
       for (const [guildId] of c.guilds.cache) {
-        await c.application?.commands.set(desiredCommands, guildId);
-      }
-      // Register /stop globally so it is available in DM bridge contexts
-      // where there is no guild scope.
-      try {
-        await c.application?.commands.set(desiredCommands);
-      } catch (e) {
-        process.stderr.write(`mixdog discord: global /stop register failed: ${e?.message}\n`);
+        await c.application?.commands.set([], guildId);
       }
-      process.stderr.write(`mixdog discord: /stop command registered (${c.guilds.cache.size} guild(s))
+      process.stderr.write(`mixdog discord: application commands cleared (${c.guilds.cache.size} guild(s))
 `);
     } catch (err) {
-      process.stderr.write(`mixdog discord: slash command registration failed: ${err}
+      process.stderr.write(`mixdog discord: slash command cleanup failed: ${err}
 `);
     }
   });

package/src/runtime/channels/lib/inbound-handler.mjs

@@ -58,11 +58,27 @@ const inboundQueue = (() => {
 getBackend().onMessage = (msg) => {
   const receivedAtMs = Number.isFinite(msg.receivedAtMs) ? msg.receivedAtMs : Date.now();
   const onMessageAtMs = Date.now();
-  if (!getBridgeRuntimeConnected() || !getBridgeOwnershipSnapshot().owned) {
-    refreshBridgeOwnershipSafe();
+  const gateBlocked = (!getBridgeRuntimeConnected() || !getBridgeOwnershipSnapshot().owned)
+    ? "bridge-seat"
+    : (!getChannelBridgeActive() ? "bridge-inactive" : "");
+  if (gateBlocked) {
+    if (gateBlocked === "bridge-seat") refreshBridgeOwnershipSafe();
+    // CC parity: an inbound message is never silently swallowed. The bridge
+    // seat may be mid-handover or the channel bridge may still be activating
+    // (app relaunch / boot); retry with backoff before giving up, and make
+    // the final drop loud so a real loss stays diagnosable.
+    const attempt = (msg.__bridgeGateRetries || 0) + 1;
+    if (attempt <= 5) {
+      msg.__bridgeGateRetries = attempt;
+      msg.receivedAtMs = receivedAtMs;
+      setTimeout(() => {
+        try { getBackend().onMessage?.(msg); } catch { /* best-effort */ }
+      }, 2000 * attempt)?.unref?.();
+    } else {
+      try { process.stderr.write(`mixdog: inbound message dropped after ${attempt - 1} ${gateBlocked} retries (channel=${msg.chatId}, id=${msg.messageId})\n`); } catch {}
+    }
     return;
   }
-  if (!getChannelBridgeActive()) return;
   if (shouldDropDuplicateInbound(msg)) return;
   // No label concept anymore: the channel id IS the identifier.
   recordFetchedMessages(msg.chatId, msg.chatId, [{ id: msg.messageId }], { markRead: true });

package/src/runtime/channels/lib/scheduler.mjs

@@ -88,6 +88,7 @@ class Scheduler {
   running = /* @__PURE__ */ new Set();
   injectFn = null;
   sendFn = null;
+  injectReadyFn = null;
   pendingCheck = null;
   // Activity tracking
   lastActivity = 0;
@@ -114,6 +115,16 @@ class Scheduler {
   setSendHandler(fn) {
     this.sendFn = fn;
   }
+  /** Probe for a live Lead bridge seat. When set, the CC-parity interactive
+   *  inject only fires while it reports true; otherwise the visible-session
+   *  fallback keeps the fire from being lost. Unset → inject when wired. */
+  setInjectReadyCheck(fn) {
+    this.injectReadyFn = typeof fn === 'function' ? fn : null;
+  }
+  injectReady() {
+    if (!this.injectReadyFn) return true;
+    try { return !!this.injectReadyFn(); } catch { return false; }
+  }
   setPendingCheck(fn) {
     this.pendingCheck = typeof fn === 'function' ? fn : null;
   }
@@ -473,6 +484,7 @@ ${Scheduler.INSTANCE_UUID}`;
       await this.markDoneWithRetry(schedule.name);
     } catch (err) {
       process.stderr.write(`mixdog scheduler: ${schedule.name} one-shot failed: ${err} — leaving pending for retry\n`);
+      this.notifyFailure(schedule, `one-shot failed: ${err?.message || err} — left pending for retry`);
     }
   }
   restart() {
@@ -556,6 +568,7 @@ ${Scheduler.INSTANCE_UUID}`;
     if (!prompt) {
       process.stderr.write(`mixdog scheduler: prompt not found for "${schedule.name}"
 `);
+      this.notifyFailure(schedule, "prompt not found — fire skipped");
       return false;
     }
     // target 'channel' → relay the run result to the schedule's channel_id
@@ -570,14 +583,34 @@ ${Scheduler.INSTANCE_UUID}`;
   async fireTimedPrompt(schedule, type, prompt, channelId, { awaitDispatch = false } = {}) {
     logSchedule(`firing ${schedule.name} (${type})
 `);
-    // Legacy interactive Lead-session inject is retired: every schedule fire
-    // runs as its own visible session below (New-task parity, user decision).
-    if (this.running.has(schedule.name)) return false;
+    if (this.running.has(schedule.name)) {
+      // Not silent anymore: overlap skips were invisible and read as the
+      // scheduler "ignoring" a fire.
+      logSchedule(`${schedule.name}: skipped — previous run still in progress\n`);
+      return false;
+    }
+    // CC parity (reference messageQueueManager.ts): interactive schedules
+    // enqueue into the live Lead session's command queue as system-generated
+    // task notifications (priority 'later'), exactly like inbound channel
+    // messages — enqueue counts as the fire. The visible-session run below
+    // remains the non-interactive path AND the fallback when no live Lead
+    // seat is attached, so a fire is never lost.
+    if (type === "interactive" && this.injectFn && this.injectReady()) {
+      try {
+        const wrapped = this.wrapPrompt(schedule.name, prompt, type);
+        this.injectFn(channelId, `schedule:${schedule.name}`, " ", { type: "schedule", instruction: wrapped });
+        logSchedule(`${schedule.name}: injected into Lead session queue (CC-parity interactive fire)\n`);
+        return true;
+      } catch (err) {
+        logSchedule(`${schedule.name}: Lead inject failed (${err?.message || err}) — falling back to visible session run\n`);
+      }
+    }
     this.running.add(schedule.name);
     const presetId = schedule.model;
     if (!presetId) {
       this.running.delete(schedule.name);
       logSchedule(`${schedule.name}: missing required "model" in schedule config — dispatch rejected\n`);
+      this.notifyFailure(schedule, 'missing "model" in schedule config — dispatch rejected');
       return false;
     }
     // Cron (recurring) keeps the fire-and-forget contract: return truthy now
@@ -601,6 +634,10 @@ ${Scheduler.INSTANCE_UUID}`;
       .catch((err) => {
         this.running.delete(schedule.name);
         logSchedule(`${schedule.name} LLM error: ${err.message}\n`);
+        // The cron fire-and-forget contract swallowed failures entirely;
+        // surface them on the channel so a failed scheduled run is never
+        // silent (one-shots propagate via the awaitDispatch throw instead).
+        if (!awaitDispatch) this.notifyFailure(schedule, `run failed: ${err.message}`);
         if (awaitDispatch) throw err;
         return false;
       });
@@ -608,6 +645,17 @@ ${Scheduler.INSTANCE_UUID}`;
     return true;
   }
   // ── Helpers ─────────────────────────────────────────────────────────
+  /** Best-effort failure notice to the schedule's channel (or the main
+   *  channel) so scheduled fires never fail silently. Respects an explicit
+   *  channel opt-out ("false" → resolveChannel yields "" → no notice). */
+  notifyFailure(schedule, reason) {
+    try {
+      if (!this.sendFn) return;
+      const target = this.resolveChannel(schedule?.channelId);
+      if (!target) return;
+      Promise.resolve(this.sendFn(target, `schedule "${schedule?.name}": ${reason}`)).catch(() => {});
+    } catch { /* best-effort */ }
+  }
   /** Resolve prompt: inline text from the row, with a prompts-dir file
    *  fallback for legacy `<name>.md` references. */
   resolvePrompt(schedule) {

package/src/runtime/channels/lib/worker-main.mjs

@@ -435,6 +435,10 @@ function forwardLifecycleToDiscord(channelId, content) {
 scheduler.setInjectHandler((channelId, name, content, options) => {
   injectAndRecord(channelId, name, content, options);
 });
+// CC-parity interactive schedule fires may only inject while this process
+// actually holds the live bridge seat; otherwise the scheduler falls back to
+// the visible-session run so the fire is never lost.
+scheduler.setInjectReadyCheck(() => bridgeRuntimeConnected && currentOwnerState().owned);
 scheduler.setSendHandler(async (channelId, text) => {
   // Skip protocol: a scheduler-task emitting `[meta:silent]` has nothing to
   // report — suppress the channel send entirely (no noise). Mirrors the

package/src/runtime/channels/tool-defs.mjs

@@ -25,7 +25,8 @@ export const TOOL_DEFS = [
           description: "Discord components."
         }
       },
-      required: ["message"]
+      required: ["message"],
+      additionalProperties: false
     }
   },
   {
@@ -39,7 +40,8 @@ export const TOOL_DEFS = [
         channel: { type: "string", description: "Discord channel id." },
         limit: { type: "number", description: "Max messages." }
       },
-      required: ["channel"]
+      required: ["channel"],
+      additionalProperties: false
     }
   },
   // memory and recall_memory tools are now provided by memory-service.mjs via MCP

package/src/runtime/memory/lib/query-handlers.mjs

@@ -697,11 +697,15 @@ export function createQueryHandlers({
       }
       const excludeStatuses = includeArchived ? [] : ['archived']
       const VALID_LAST_CATS = new Set(['rule', 'constraint', 'decision', 'fact', 'goal', 'preference', 'task', 'issue'])
-      const catList = category == null
+      const requestedCats = category == null
         ? []
-        : (Array.isArray(category) ? category : [category])
+        : [...new Set((Array.isArray(category) ? category : [category])
             .map((c) => String(c).trim().toLowerCase())
-            .filter((c) => VALID_LAST_CATS.has(c))
+            .filter((c) => VALID_LAST_CATS.has(c)))]
+      // Asking for every public category is semantically unfiltered. Keeping
+      // it as a restrictive filter drops fresh unclassified raw turns before
+      // cycle1 assigns a category, which can hide the immediately prior chat.
+      const catList = requestedCats.length === VALID_LAST_CATS.size ? [] : requestedCats
       // 1) rank sessions by most-recent activity (MAX(ts)) over the SAME pool
       //    the fill draws from — roots (status-filtered) + unchunked raw
       //    leaves, member rows excluded — so a session ranked here can never
@@ -720,6 +724,10 @@ export function createQueryHandlers({
         selParams.push(projectScope)
         selWhere.push(`(project_id IS NULL OR project_id = $${selParams.length})`)
       }
+      if (catList.length > 0) {
+        const ph = catList.map((c) => { selParams.push(c); return `$${selParams.length}` }).join(',')
+        selWhere.push(`lower(coalesce(category, '')) IN (${ph})`)
+      }
       if (excludeStatuses.length > 0) {
         const ph = excludeStatuses.map((s) => { selParams.push(s); return `$${selParams.length}` }).join(',')
         selWhere.push(`(status IS NULL OR status NOT IN (${ph}))`)