mixdog 0.9.92 → 0.9.93

package/src/runtime/agent/orchestrator/session/tool-batch.mjs

@@ -37,6 +37,7 @@ import {
     parseNativeToolSearchPayload,
 } from './loop/tool-helpers.mjs';
 import { restoreToolCallBodyForId } from './loop/stored-tool-args.mjs';
+import { commitSessionCwdProbe } from '../tools/shell-state.mjs';
 
 function classifyToolReturn(value) {
     const normalized = normalizeToolEnvelope(value);
@@ -50,6 +51,7 @@ export async function processToolBatch(ctx) {
         crossTurnCalls, crossTurnCap, sessionAgent, steeringLadder,
         pushToolResultMessage, throwIfAborted, repeatFailLimit,
     } = ctx;
+    const executeToolFn = typeof ctx.executeToolFn === 'function' ? ctx.executeToolFn : executeTool;
     let dedupStubTotal = ctx.dedupStubTotal;
     let editCount = ctx.editCount;
         // Execute each tool and append results.
@@ -91,16 +93,11 @@ export async function processToolBatch(ctx) {
         // between two tool results of the same multi-tool turn (which would put a
         // user message between tool(A) and tool(B) and break provider pairing).
         const _batchNewMessages = [];
-        // Ordered-mutation batch gate. apply_patch is a mutation tool (never
-        // eager-dispatchable), so multiple apply_patch calls in ONE assistant
-        // turn already execute serially in call-index order via this loop.
-        // This flag records the FIRST ordered mutation whose execution failed
-        // in this batch; every LATER apply_patch in the same batch is then
-        // skipped (not executed) because its edits may depend on the failed
-        // one and applying them against unchanged/partially-changed files
-        // risks corrupt or misplaced writes. Only apply_patch is gated —
-        // non-mutation tools (reads/grep/shell/...) keep their normal
-        // parallelism and behavior. Reset per batch (per assistant turn).
+        // Ordered-mutation batch gate. Each apply_patch is an eager-dispatch
+        // barrier: side effects overlap within the current segment, but no
+        // later segment starts before the loop crosses the patch in model
+        // order. A failed patch prevents every unstarted later side effect;
+        // known read-only calls may still complete for diagnostics.
         let _orderedMutationFailed = null;
         for (let callIndex = 0; callIndex < calls.length; callIndex += 1) {
             const call = calls[callIndex];
@@ -196,22 +193,18 @@ export async function processToolBatch(ctx) {
                 }
             }
             // Ordered-mutation skip: an earlier apply_patch in THIS batch failed,
-            // so this later apply_patch is skipped rather than executed. Restore
-            // its full patch body first (this call never ran) so the model can
-            // re-issue it cleanly in a new turn instead of copying back a
-            // `[mixdog compacted …]` placeholder. Emits a matching is_error
-            // tool_result so the assistant tool_use is not orphaned.
-            // Full-parallel caveat: a call that ALREADY started (pending eager
-            // promise) cannot be "skipped" — its side effects are running, so
-            // its real result must be consumed below. The gate only skips
-            // calls that have not started (apply_patch never starts eagerly).
+            // so this later side-effect call is skipped rather than executed.
+            // Restore a later patch's full body first so it can be re-issued.
+            // `skipped` is deliberate: the call never started, so it is neither
+            // a tool failure nor a cancellation. The earlier patch remains the
+            // structural failure that drives retry/stop-hook behavior.
             if (_orderedMutationFailed && _isOrderedGateSkippable(call.name) && !pending.has(call.id)) {
                 if (call?.id) restoreToolCallBodyForId(assistantTurnMsg, calls, call.id);
                 pushToolResultMessage({
                     role: 'tool',
-                    content: `Error: [ordered-mutation-skip] an earlier apply_patch in this same tool batch (call index ${_orderedMutationFailed.index + 1}) failed; ordered mutations in one batch are all-or-nothing after a failure, so this later \`${call.name}\` was NOT executed — it may depend on the failed mutation and running it now against unchanged/partially-changed state could corrupt files. Re-issue it in a new turn after resolving the earlier failure.`,
+                    content: `[prerequisite-failed] an earlier apply_patch in this same tool batch (call index ${_orderedMutationFailed.index + 1}) failed, so this later \`${call.name}\` was skipped without starting. Re-issue it after resolving the patch failure.`,
                     toolCallId: call.id,
-                    toolKind: 'error',
+                    toolKind: 'skipped',
                 });
                 continue;
             }
@@ -320,7 +313,7 @@ export async function processToolBatch(ctx) {
                         toolEndedAt = Date.now();
                         _resultKind = 'error';
                     } else {
-                        result = await executeTool(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id, signal, notifyFn: opts.notifyFn, toolApprovalHook: opts.onToolApproval, iteration: iterations });
+                        result = await executeToolFn(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id, signal, notifyFn: opts.notifyFn, toolApprovalHook: opts.onToolApproval, iteration: iterations, deferShellCwdCommit: true });
                         toolEndedAt = Date.now();
                         // Boundary: tool-return string convention → structural kind.
                         // The only prefix check in this codebase; downstream layers
@@ -342,6 +335,9 @@ export async function processToolBatch(ctx) {
                 result = `Error: ${err instanceof Error ? err.message : String(err)}`;
                 _resultKind = 'error';
             }
+            if (_isShellTool(call.name)) {
+                commitSessionCwdProbe(sessionId, call.id);
+            }
             // CENTRAL ENVELOPE NORMALIZE (general newMessages channel).
             // executeTool (serial + eager) and cache/error paths above all
             // funnel into `result`. Split ONCE here: downstream post-processing
@@ -506,7 +502,7 @@ export async function processToolBatch(ctx) {
             if (_isMutationTool(call.name)) {
                 epoch.mutation += 1;
                 // Record the first failed ordered mutation in this batch so any
-                // LATER apply_patch is skipped by the gate at the top of the
+                // later side effect is skipped by the gate at the top of the
                 // loop. Keyed on exec outcome (not post-processing): a mutation
                 // whose write succeeded but post-processing threw still landed
                 // on disk, so it must NOT block subsequent ordered patches.

package/src/runtime/agent/orchestrator/stall-policy.mjs

@@ -130,22 +130,31 @@ export const PROVIDER_SSE_IDLE_TIMEOUT_MS = resolveTimeoutMs(
 // SEMANTIC progress (message/content/tool deltas) rather than raw keepalive
 // bytes (Anthropic `:ping`, comment frames). A truly silent stream — one that
 // emits no semantic event for this window — trips it; a live extended-thinking
-// stream (which emits thinking deltas) stays alive. Default 120s, floor 10s,
-// env-overridable and disablable via MIXDOG_ENABLE_STREAM_WATCHDOG=0.
+// stream (which emits thinking deltas) stays alive. Floor 10s, env-overridable
+// and disablable via MIXDOG_ENABLE_STREAM_WATCHDOG=0.
+//
+// 2026-07-05 trace audit: effort-mode (output_config.effort) claude streams
+// can deliver NO deltas during the thinking phase — the whole thinking+text
+// body flushes at the end (44/47 slow turns had stream_total-ttft < 2s;
+// silent-window token rate a steady ~92 tok/s, i.e. live generation, not a
+// wedge). So a "semantic-silent" stream is NOT necessarily dead.
+//
+// 2026-08-03 v3 postmortem: this window used to be DERIVED from the agent
+// stall budget (warn − tick ≈ 285s). A harness that tightened STALL_TIMEOUT_S
+// to 300s silently collapsed it to 135s, which deterministically beheaded
+// live long-thinking turns (regex-chess / circuit-fibsqrt: ttft ~1.5s, then
+// killed at exactly 135s of silent thinking, 4 attempts ≈ 552s per turn).
+// Reference parity: Codex aborts only after a 300s single-gap silence
+// (DEFAULT_STREAM_IDLE_TIMEOUT_MS); Claude Code ships its watchdog OFF by
+// default and falls back to non-streaming when it does abort. The default is
+// therefore a FIXED 300s, decoupled from the warn math. The only remaining
+// coupling is the ordering guarantee: cap at (abort − tick) so the provider
+// layer — which can retry or fall back non-streaming — always fires strictly
+// before the agent stall watchdog's terminal abort.
 export const PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS = resolveTimeoutMs(
     ['MIXDOG_PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS', 'MIXDOG_PROVIDER_SSE_IDLE_TIMEOUT_MS'],
-    // 2026-07-05 trace audit: effort-mode (output_config.effort) sonnet-5
-    // streams deliver NO deltas during the thinking phase — the whole
-    // thinking+text body flushes at the end (44/47 slow turns had
-    // stream_total-ttft < 2s; silent-window token rate a steady ~92 tok/s,
-    // i.e. live generation, not a wedge). Successful turns topped out at
-    // ttft 171s while 13 kills sat at exactly ~183s fetch→fetch — the old
-    // 180s window was beheading every turn whose silent thinking ran past
-    // it, then retrying the whole thinking run from zero. Raised to the
-    // policy ceiling (STALL_WARN - tick ≈ 285s); the agent stall watchdog
-    // (worker 300s) remains the true-wedge backstop just above it.
-    PROVIDER_MAX_BEFORE_WARN_MS,
-    { minMs: 10_000, maxMs: STALL_WARN_MS },
+    300_000,
+    { minMs: 10_000, maxMs: Math.max(10_000, STALL_ABORT_MS - STALL_TICK_MS) },
 );
 
 // Named terminal error for a mid-stream SEMANTIC idle abort. Distinct from a
@@ -246,15 +255,16 @@ export const PROVIDER_WS_FIRST_MEANINGFUL_TIMEOUT_MS = resolveTimeoutMs(
     { minMs: 10_000, maxMs: STALL_WARN_MS },
 );
 
-// WS semantic idle uses the same default ceiling as OpenAI HTTP/SSE semantic
-// idle. This is semantic progress only (not the WS inter-chunk byte timer), so
-// reasoning/text/tool deltas reset it while metadata cannot. Keep the default
-// at PROVIDER_MAX_BEFORE_WARN_MS (~285s), strictly below the 300s worker
-// watchdog, rather than rounding it to 300s.
+// WS semantic idle uses the same default as the SSE semantic idle above
+// (fixed 300s, decoupled from the agent stall-budget warn math — see that
+// comment for the 135s-collapse regression). This is semantic progress only
+// (not the WS inter-chunk byte timer), so reasoning/text/tool deltas reset it
+// while metadata cannot. Capped at (abort − tick) so the provider layer fires
+// strictly below the agent stall watchdog.
 export const PROVIDER_WS_SEMANTIC_IDLE_TIMEOUT_MS = resolveTimeoutMs(
     ['MIXDOG_PROVIDER_WS_SEMANTIC_IDLE_TIMEOUT_MS', 'MIXDOG_PROVIDER_WS_OUTPUT_IDLE_TIMEOUT_MS'],
-    PROVIDER_MAX_BEFORE_WARN_MS,
-    { minMs: 10_000, maxMs: PROVIDER_MAX_BEFORE_WARN_MS },
+    300_000,
+    { minMs: 10_000, maxMs: Math.max(10_000, STALL_ABORT_MS - STALL_TICK_MS) },
 );
 
 // First retry has a small floor (250ms) instead of 0ms: an immediate reissue on

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool.mjs

@@ -600,7 +600,10 @@ export async function executeBashTool(args, workDir, options = {}) {
         // so the exit code the model sees is unchanged.
         let syncCommand = wrappedCommand;
         try {
-            const _stateFile = stateFilePath(_sessionCwdKey);
+            const _stateFile = stateFilePath(
+                _sessionCwdKey,
+                options?.deferShellCwdCommit === true ? options?.toolCallId : null,
+            );
             if (_stateFile) {
                 syncCommand = (process.platform === 'win32' && shellType === 'powershell')
                     ? wrapPowerShellWithCwdProbe(wrappedCommand, _stateFile)

package/src/runtime/agent/orchestrator/tools/builtin/builtin-tools.mjs

@@ -23,9 +23,9 @@ function _shellMaxTimeoutMs() {
     return Math.max(parsed > 0 ? parsed : 600_000, _shellDefaultTimeoutMs());
 }
 
-// PowerShell-only syntax cheat, injected into the shell tool description when
-// the host default shell is PowerShell (win32). process.platform is fixed for
-// the process lifetime, so this is evaluated once at module load.
+// PowerShell-only syntax cheat, kept next to the command argument when the host
+// default shell is PowerShell (win32). process.platform is fixed for the
+// process lifetime, so this is evaluated once at module load.
 const _shellSyntaxCheat =
     process.platform === 'win32'
         ? ' PowerShell: grep→Select-String, tail→Get-Content -Tail, head→Get-Content -TotalCount, /c/→C:\\, if && is unsupported use ;, $PID is reserved.'
@@ -68,18 +68,18 @@ export const BUILTIN_TOOLS = [
                 limit: { type: 'number', minimum: 1, description: 'Max lines after offset. Defaults to 2000.' },
             },
             required: ['path'],
+            additionalProperties: false,
         },
     },
     {
         name: 'shell',
         title: 'Mixdog Shell',
         annotations: { title: 'Mixdog Shell', readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, compressible: true },
-        description: 'Runs a shell command and returns its output. Use async for sleep/watch/dev loops.'
-            + `${_shellSyntaxCheat} ${TOOL_ASYNC_EXECUTION_CONTRACT}`,
+        description: `Run a shell command. ${TOOL_ASYNC_EXECUTION_CONTRACT}`,
         inputSchema: {
             type: 'object',
             properties: {
-                command: { type: 'string', description: 'Command.' },
+                command: { type: 'string', description: `Command.${_shellSyntaxCheat}` },
                 cwd: { type: 'string', description: 'Working directory; persists across calls. Omit to reuse; absolute path changes it.' },
                 timeout: {
                     type: 'number',
@@ -92,6 +92,7 @@ export const BUILTIN_TOOLS = [
                 shell: { type: 'string', enum: ['bash', 'powershell'], description: 'Force shell. Windows defaults to PowerShell; bash = Git Bash/POSIX.' },
             },
             required: ['command'],
+            additionalProperties: false,
         },
     },
     {
@@ -107,6 +108,7 @@ export const BUILTIN_TOOLS = [
                 timeout_ms: { type: 'number', description: 'Wait timeout ms.' },
             },
             required: [],
+            additionalProperties: false,
         },
     },
     {
@@ -147,6 +149,7 @@ export const BUILTIN_TOOLS = [
                 { required: ['pattern'] },
                 { required: ['glob'] },
             ],
+            additionalProperties: false,
         },
     },
     {
@@ -175,6 +178,7 @@ export const BUILTIN_TOOLS = [
                 offset: { type: 'number', description: 'Skip entries.' },
             },
             required: ['pattern'],
+            additionalProperties: false,
         },
     },
     {
@@ -196,6 +200,7 @@ export const BUILTIN_TOOLS = [
                 head_limit: { type: 'number', description: 'Max paths. Defaults to 25.' },
             },
             required: ['query'],
+            additionalProperties: false,
         },
     },
     {
@@ -217,6 +222,7 @@ export const BUILTIN_TOOLS = [
                 offset: { type: 'number', description: 'Skip N entries for paging.' },
             },
             required: [],
+            additionalProperties: false,
         },
     },
 ];

package/src/runtime/agent/orchestrator/tools/code-graph-tool-defs.mjs

@@ -3,19 +3,20 @@ export const CODE_GRAPH_TOOL_DEFS = [
     name: 'code_graph',
     title: 'Code Graph',
     annotations: { title: 'Code Graph', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, compressible: false, compressibleLossless: true },
-    description: 'Repo code structure/flow over source files only. File modes take files[]; symbol modes find_symbol/symbol_search/search/references/callers/callees take symbols[]. Exact identifiers use find_symbol/references/callers/callees and keywords use symbol_search/search. Unsupported target arrays are omitted, never silently mixed.',
+    description: 'Repo code structure/flow over source files. File modes take files[]; symbol modes take symbols[] — exact identifiers via find_symbol/references/callers/callees, keywords via symbol_search/search. Unsupported target arrays are omitted, never mixed.',
     inputSchema: {
       type: 'object',
       properties: {
-        mode: { type: 'string', enum: ['overview', 'imports', 'dependents', 'related', 'impact', 'symbols', 'find_symbol', 'symbol_search', 'search', 'references', 'callers', 'callees'], description: 'File modes={overview,imports,dependents,related,impact}; symbols with files→files[] file outline; symbol modes={find_symbol,symbol_search,search,references,callers,callees}; fileless symbols→symbol_search keywords.' },
+        mode: { type: 'string', enum: ['overview', 'imports', 'dependents', 'related', 'impact', 'symbols', 'find_symbol', 'symbol_search', 'search', 'references', 'callers', 'callees'], description: 'File modes={overview,imports,dependents,related,impact}; symbols with files[]=file outline; the rest are symbol modes.' },
         files: { anyOf: [{ type: 'string' }, { type: 'array', items: { type: 'string' }, minItems: 1 }], description: 'Source file path(s); supported targets only.' },
-        symbols: { anyOf: [{ type: 'string' }, { type: 'array', items: { type: 'string' }, minItems: 1 }], description: 'Exact identifiers (find_symbol/references/callers/callees) or keywords (symbol_search/search); multiple exact symbols use one symbols[] call.' },
+        symbols: { anyOf: [{ type: 'string' }, { type: 'array', items: { type: 'string' }, minItems: 1 }], description: 'Exact identifiers or keywords; batch multiple in one symbols[].' },
         body: { type: 'boolean', description: 'Include body.' },
         limit: { type: 'number', minimum: 1, description: 'Max results.' },
         depth: { type: 'number', minimum: 1, maximum: 5, description: 'Caller depth.' },
         page: { type: 'number', minimum: 1, description: 'Caller page.' },
       },
       required: ['mode'],
+      additionalProperties: false,
     },
   },
 ];

package/src/runtime/agent/orchestrator/tools/lib/pwsh-standby-pool.mjs

@@ -48,18 +48,22 @@ const EXPECTED_ARGS = Object.freeze(['-NoLogo', '-NoProfile', '-NonInteractive',
 // with the same `$?`→0/1 exit mapping pwsh -Command applies implicitly, then
 // emits `<<<MIXDOG_DONE_<nonce>:<code>>>>` on stdout and
 // `<<<MIXDOG_DONE_<nonce>>>>` on stderr (both streams provably drained).
-// Each command pipes through Microsoft.PowerShell.Core\Out-Default: the whole
-// marker loop is ONE top-level pipeline, so without an explicit per-command
-// formatting terminator Format-Table kept object output buffered PAST the done
-// sentinel and captures came back empty (`Get-ChildItem | Select-Object` →
-// no output). The per-command Out-Default flushes formatted output before the
-// sentinel is written, restoring one-shot `pwsh -Command` parity.
+// Each command renders through Out-String -Stream and writes lines straight
+// to [Console]::Out: host-side Out-Default table rendering proved ASYNC in
+// long-lived standbys — formatted object output could flush AFTER the done
+// sentinel (whole tables lost from the capture, then surfacing as stale
+// bytes at the head of the NEXT command's capture). Rendering inside the
+// pipeline and emitting via the SAME Console writer as the sentinel makes
+// the ordering structural: every success-stream byte is on stdout before the
+// sentinel line. Verified empirically: table shape/blank lines, long lines
+// (no 120-col wrap), Write-Error rendering, and the `$?` exit mapping all
+// match one-shot `pwsh -Command`.
 // stdin EOF exits the process with the LAST command's code — that is exactly
 // what background-promotion relies on for its exit-file. A user script that
 // calls `exit N` terminates the whole process with N (identical code to the
 // one-shot path); the caller settles via 'close' and the entry is discarded.
 function _standbyBootScript(nonce) {
-    const runSentinel = `<<<MIXDOG_RUN_${nonce}>>>`;
+    const runPrefix = `<<<MIXDOG_RUN_${nonce}:`;
     const donePrefix = `<<<MIXDOG_DONE_${nonce}`;
     return [
         '$null = & {0}',
@@ -86,10 +90,15 @@ function _standbyBootScript(nonce) {
         '$__code = 0',
         'while ($true) {',
         '  $__buf = New-Object System.Text.StringBuilder',
+        "  $__tok = ''",
         '  while ($true) {',
         '    $__line = $__sr.ReadLine()',
         '    if ($null -eq $__line) { exit $__code }',
-        `    if ($__line -eq '${runSentinel}') { break }`,
+        // Per-COMMAND token: the RUN line carries a fresh token minted at
+        // take() time; DONE markers echo it back. A stale DONE from an
+        // earlier command on this entry can therefore NEVER match the
+        // current command's marker prefix (same-nonce offset hardening).
+        `    if ($__line.StartsWith('${runPrefix}') -and $__line.EndsWith('>>>')) { $__tok = $__line.Substring(${runPrefix.length}, $__line.Length - ${runPrefix.length} - 3); break }`,
         '    [void]$__buf.AppendLine($__line)',
         '  }',
         '  foreach ($__n in @(Get-ChildItem env: | ForEach-Object Name)) { if (-not $__baseEnv.ContainsKey($__n)) { Remove-Item ("env:$__n") -ErrorAction SilentlyContinue } }',
@@ -108,7 +117,7 @@ function _standbyBootScript(nonce) {
         '  $global:__MIXDOG_RC = 1',
         '  try {',
         "    $__sc = [ScriptBlock]::Create($__buf.ToString() + [Environment]::NewLine + 'if ($?) { $global:__MIXDOG_RC = 0 } else { $global:__MIXDOG_RC = 1 }')",
-'    & $__sc | Microsoft.PowerShell.Core\\Out-Default',
+'    & $__sc | Microsoft.PowerShell.Utility\\Out-String -Stream | Microsoft.PowerShell.Core\\ForEach-Object { [Console]::Out.WriteLine($_) }',
         '  } catch {',
         '    $global:__MIXDOG_RC = 1',
         "    [Console]::Error.WriteLine('Exception: ' + $_.Exception.Message)",
@@ -116,8 +125,8 @@ function _standbyBootScript(nonce) {
         '  $__code = $global:__MIXDOG_RC',
         '  [Console]::Out.Flush()',
         '  [Console]::Error.Flush()',
-        `  [Console]::Out.WriteLine('${donePrefix}:' + $__code + '>>>')`,
-        `  [Console]::Error.WriteLine('${donePrefix}>>>')`,
+        `  [Console]::Out.WriteLine('${donePrefix}:' + $__tok + ':' + $__code + '>>>')`,
+        `  [Console]::Error.WriteLine('${donePrefix}:' + $__tok + '>>>')`,
         '}',
     ].join('\n');
 }
@@ -227,11 +236,19 @@ export function takePwshStandby({ shell, shellArgs, env }) {
         entry.child.stderr?.ref?.();
     } catch { /* best-effort */ }
     _topUp(shell, env, sig);
+    // Fresh token per command: DONE markers are only valid when they echo
+    // this token, so any straggler marker from a previous command on the
+    // same entry (same nonce) is inert for this capture.
+    const runToken = randomBytes(6).toString('hex');
     return {
         child: entry.child,
         nonce: entry.nonce,
-        runSentinel: `<<<MIXDOG_RUN_${entry.nonce}>>>`,
-        doneMarkerPrefix: `<<<MIXDOG_DONE_${entry.nonce}`,
+        runSentinel: `<<<MIXDOG_RUN_${entry.nonce}:${runToken}>>>`,
+        doneMarkerPrefix: `<<<MIXDOG_DONE_${entry.nonce}:${runToken}`,
+        // Entry-scoped prefix: lines matching this but NOT doneMarkerPrefix
+        // are stale markers from an earlier command — the caller drops them
+        // from the capture instead of surfacing sentinel noise.
+        staleMarkerPrefix: `<<<MIXDOG_DONE_${entry.nonce}`,
         run(spawnCommand, cwdForRun) {
             const esc = String(cwdForRun || '').replace(/'/g, "''");
             const prelude = esc
@@ -240,7 +257,7 @@ export function takePwshStandby({ shell, shellArgs, env }) {
             try {
                 const body = prelude + String(spawnCommand ?? '');
                 entry.child.stdin.write(body.endsWith('\n') ? body : `${body}\n`, 'utf8');
-                entry.child.stdin.write(`<<<MIXDOG_RUN_${entry.nonce}>>>\n`, 'utf8');
+                entry.child.stdin.write(`<<<MIXDOG_RUN_${entry.nonce}:${runToken}>>>\n`, 'utf8');
                 return true;
             } catch {
                 // Feed failed (child died in the take→run window): kill so the
@@ -276,6 +293,22 @@ export function takePwshStandby({ shell, shellArgs, env }) {
                 _killEntry(entry);
                 return false;
             }
+            // Drain bytes a previous command left in the paused streams (late
+            // flushes that raced past the caller's detach). Without this they
+            // would surface at the HEAD of the next command's capture.
+            // Diagnostic (2026-08-04, intermittent empty-capture reports in a
+            // long-lived host): any stale byte seen here PROVES output escaped
+            // a finished command's capture on this entry — the exact precursor
+            // of a same-nonce marker offset corrupting the NEXT command. Rare
+            // by construction, so the log is always-on and one line.
+            let _staleBytes = 0;
+            try { let b; while ((b = c.stdout.read()) !== null) { _staleBytes += b.length; } } catch { /* best-effort */ }
+            try { let b; while ((b = c.stderr.read()) !== null) { _staleBytes += b.length; } } catch { /* best-effort */ }
+            if (_staleBytes > 0) {
+                try {
+                    process.stderr.write(`[pwsh-standby] recycle drained ${_staleBytes}B stale output (pid=${c.pid}) — late flush escaped the previous command's capture\n`);
+                } catch { /* diagnostics only */ }
+            }
             entry.taken = false;
             entry.consumed = false;
             entry.spawnedAt = Date.now() - STANDBY_READY_AGE_MS;

package/src/runtime/agent/orchestrator/tools/patch/v4a-convert.mjs

@@ -208,6 +208,70 @@ function findContextTolerantWindow(sourceLines, oldLines, oldTags) {
   return windows.length === 1 ? { start: windows[0] } : null;
 }
 
+// Last-resort recovery for a model that accidentally copied 1-2 unrelated
+// unchanged context lines just outside the real edit. Trim only contiguous
+// outer ' ' lines — never '-' or '+' lines — and accept the shortened old
+// block only when it matches byte-exactly at exactly one place in the ENTIRE
+// file. Requiring a deletion keeps this fallback off insertion-only hunks;
+// exact whole-block matching proves every deletion line is current. Any
+// competing trim plan or duplicate occurrence is ambiguous and stays a hard
+// context miss.
+function findOuterContextTrimmedWindow(sourceLines, hunk, stats) {
+  const body = (hunk?.lines || []).filter(
+    (line) => typeof line === 'string'
+      && line.length > 0
+      && !isV4AEndOfFileMarker(line)
+      && (line[0] === ' ' || line[0] === '-' || line[0] === '+'),
+  );
+  if (!body.some((line) => line[0] === '-')) return null;
+
+  let leadingAvailable = 0;
+  while (leadingAvailable < body.length && body[leadingAvailable][0] === ' ') leadingAvailable++;
+  let trailingAvailable = 0;
+  while (
+    trailingAvailable < body.length - leadingAvailable
+    && body[body.length - 1 - trailingAvailable][0] === ' '
+  ) trailingAvailable++;
+  if (leadingAvailable === 0 && trailingAvailable === 0) return null;
+
+  for (let totalTrimmed = 1; totalTrimmed <= 2; totalTrimmed++) {
+    const plans = [];
+    let ambiguous = false;
+    for (let leading = 0; leading <= Math.min(totalTrimmed, leadingAvailable); leading++) {
+      const trailing = totalTrimmed - leading;
+      if (trailing > trailingAvailable) continue;
+      const remainingBody = body.slice(leading, body.length - trailing);
+      if (!remainingBody.some((line) => line[0] === '-')) continue;
+      const oldLines = stats.oldLines.slice(leading, stats.oldLines.length - trailing);
+      const newLines = stats.newLines.slice(leading, stats.newLines.length - trailing);
+      if (oldLines.length === 0) continue;
+
+      const starts = [];
+      outer: for (let i = 0; i + oldLines.length <= sourceLines.length; i++) {
+        for (let k = 0; k < oldLines.length; k++) {
+          if (sourceLines[i + k] !== oldLines[k]) continue outer;
+        }
+        starts.push(i);
+        if (starts.length > 1) break;
+      }
+      if (starts.length > 1) {
+        ambiguous = true;
+      } else if (starts.length === 1) {
+        plans.push({
+          start: starts[0],
+          oldLines,
+          newLines,
+          leading,
+          trailing,
+        });
+      }
+    }
+    if (ambiguous || plans.length > 1) return null;
+    if (plans.length === 1) return plans[0];
+  }
+  return null;
+}
+
 function resolveV4AHunkPosition(sourceLines, hunk, nextSearchLine, options = {}) {
   const stats = v4AHunkLineStats(hunk);
   if (stats.oldCount === 0 && stats.newCount === 0) return { skip: true };
@@ -223,6 +287,8 @@ function resolveV4AHunkPosition(sourceLines, hunk, nextSearchLine, options = {})
   let oldStartIdx;
   let trimmedTrailing = 0;
   let trimmedTrailingNew = 0;
+  let trimmedLeadingContext = 0;
+  let trimmedTrailingContext = 0;
   if (stats.oldCount === 0) {
     oldStartIdx = eofInsertionIndex(sourceLines);
   } else {
@@ -313,6 +379,20 @@ function resolveV4AHunkPosition(sourceLines, hunk, nextSearchLine, options = {})
       }
     }
   }
+  // A stray copied line outside the edit should not cost a failed tool turn.
+  // This fallback is deliberately narrower than the context-tolerance tier:
+  // fuzzy mode only, non-EOF, no newline-sentinel interaction, deletion hunks
+  // only, byte-exact remaining block, and one unique whole-file location.
+  if (oldStartIdx < 0 && fuzzy && !eof && trimmedTrailing === 0) {
+    const trimmed = findOuterContextTrimmedWindow(sourceLines, hunk, stats);
+    if (trimmed) {
+      oldStartIdx = trimmed.start;
+      oldLinesPattern = trimmed.oldLines;
+      newLinesPattern = trimmed.newLines;
+      trimmedLeadingContext = trimmed.leading;
+      trimmedTrailingContext = trimmed.trailing;
+    }
+  }
   if (oldStartIdx < 0) {
     const msg = `V4A hunk context not found: ${formatV4AHunkLocator(hunk)};${formatV4AContextMissHint(sourceLines, stats, anchorLine)}`;
     return { error: msg };
@@ -329,6 +409,8 @@ function resolveV4AHunkPosition(sourceLines, hunk, nextSearchLine, options = {})
     nextSearchLine: matchLen === 0 ? Math.max(0, nextSearchLine || 0) : oldStartIdx + matchLen,
     trimmedTrailing,
     trimmedTrailingNew,
+    trimmedLeadingContext,
+    trimmedTrailingContext,
   };
 }
 
@@ -764,6 +846,23 @@ export async function convertV4ASectionsToUnifiedPatch(sections, basePath, optio
           if (dropOldAt >= 0 && (!loc.trimmedTrailingNew || dropNewAt >= 0)) break;
         }
       }
+      const droppedOuterContext = new Set();
+      let leadingToDrop = loc.trimmedLeadingContext || 0;
+      for (let i = 0; i < hunk.lines.length && leadingToDrop > 0; i++) {
+        const line = hunk.lines[i];
+        if (isV4AEndOfFileMarker(line)) continue;
+        if (!line || line[0] !== ' ') break;
+        droppedOuterContext.add(i);
+        leadingToDrop--;
+      }
+      let trailingToDrop = loc.trimmedTrailingContext || 0;
+      for (let i = hunk.lines.length - 1; i >= 0 && trailingToDrop > 0; i--) {
+        const line = hunk.lines[i];
+        if (isV4AEndOfFileMarker(line)) continue;
+        if (!line || line[0] !== ' ') break;
+        droppedOuterContext.add(i);
+        trailingToDrop--;
+      }
       // Emit the body FIRST and derive the header counts from what was
       // actually emitted: the trailing-newline sentinel drop can remove a line
       // from one side only, so a header computed from the raw hunk stats can
@@ -775,6 +874,7 @@ export async function convertV4ASectionsToUnifiedPatch(sections, basePath, optio
       const srcEnd = loc.oldStartIdx + loc.matchLen;
       for (let i = 0; i < hunk.lines.length; i++) {
         const line = hunk.lines[i];
+        if (droppedOuterContext.has(i)) continue;
         if (isV4AEndOfFileMarker(line)) continue;
         const prefix = line[0];
         if (prefix === ' ' || prefix === '-') {

package/src/runtime/agent/orchestrator/tools/patch-tool-defs.mjs

@@ -38,17 +38,16 @@ const APPLY_PATCH_FREEFORM_DESCRIPTION =
 // refs/codex/codex-rs/prompts/templates/apply_patch_tool_instructions.md,
 // adapted to the JSON `patch` argument.
 const APPLY_PATCH_JSON_DESCRIPTION = [
-  'Primary file-editing tool. Send `patch` as soon as the target and change are known.',
-  'Use this V4A envelope:',
+  'Edit files with this V4A envelope:',
   '*** Begin Patch',
   '[file sections]',
   '*** End Patch',
   'Every section starts with exactly one header:',
-  '- *** Add File: <path> then one or more +content lines.',
+  '- *** Add File: <path> then +content lines.',
   '- *** Delete File: <path> with nothing after it.',
   '- *** Update File: <path>, optionally followed by *** Move to: <new path>.',
-  'Updates contain hunks introduced by @@ or @@ <enclosing class/function>. Prefix every hunk line with space (context), - (remove), or + (add); a hunk at end of file may close with *** End of File.',
-  'Copy 3 context lines above and below verbatim from the newest tool output of the file (never retype from memory; after your own patch, use post-patch content). Do not duplicate overlapping context. If context is not unique, add one or more enclosing @@ headers.',
+  'Update hunks open with @@ or @@ <enclosing class/function>; prefix every line with space (context), - (remove), or + (add); a hunk at end of file may close with *** End of File.',
+  'Copy 3 context lines above and below verbatim from the newest tool output of the file (after your own patch, use post-patch content; never retype from memory). Do not duplicate overlapping context; if context is not unique, add enclosing @@ headers.',
   'Use project-relative paths. Every added file line needs +. Never submit a compacted-history marker; re-read and create a fresh patch.',
 ].join('\n');
 
@@ -68,8 +67,10 @@ export const PATCH_TOOL_DEFS = [
       type: 'object',
       properties: {
         patch: { type: 'string', description: 'The V4A patch text to apply (format and context rules in the tool description).' },
+        post_shell: { type: 'string', description: 'Verification command run when the patch applies; skipped on patch failure.' },
       },
       required: ['patch'],
+      additionalProperties: false,
     },
   },
 ];

package/src/runtime/agent/orchestrator/tools/shell-command.mjs

@@ -492,6 +492,7 @@ export function execShellCommand({
     let _stderrData = (chunk) => taskOutput.writeStderr(chunk);
     if (_standby) {
       const donePrefix = _standby.doneMarkerPrefix;
+      const stalePrefix = _standby.staleMarkerPrefix;
       const _mk = { outDone: false, errDone: false, code: 1 };
       const tryComplete = () => {
         if (!_mk.outDone || !_mk.errDone) return;
@@ -515,6 +516,14 @@ export function execShellCommand({
               const line = tail.slice(0, idx + 1);
               tail = tail.slice(idx + 1);
               if (line.startsWith(donePrefix)) { onMarkerLine(line); continue; }
+              // Same-nonce marker with a DIFFERENT run token: a straggler
+              // from an earlier command on this standby entry. Drop it from
+              // the capture and log — this is the observable trace of the
+              // late-flush/offset condition the per-command token defuses.
+              if (stalePrefix && line.startsWith(stalePrefix)) {
+                try { process.stderr.write(`[pwsh-standby] dropped stale marker from a previous command (pid=${child.pid})\n`); } catch { /* diagnostics only */ }
+                continue;
+              }
               out += line;
             }
             if (out) write(out);