mixdog 0.9.94 → 0.9.96

package/scripts/fixtures/patch-replay-corpus.json

@@ -0,0 +1,98 @@
+[
+  {
+    "id": "eof-marker-midfile",
+    "note": "observed: a mid-file hunk carried *** End of File; the EOF-anchored seek missed and every recovery tier was gated off, so a byte-perfect context failed",
+    "expect": "applied",
+    "expect_content": { "a.txt": "one\nTWO\nthree\nfour\nfive\n" },
+    "file_snapshots": { "a.txt": "one\ntwo\nthree\nfour\nfive\n" },
+    "args": { "patch": "*** Begin Patch\n*** Update File: a.txt\n@@\n one\n-two\n+TWO\n three\n*** End of File\n*** End Patch\n" }
+  },
+  {
+    "id": "deletion-line-one-char-off",
+    "note": "observed: `first divergent line` hints whose expected/actual differ by <= 1 character (retyped from memory) on a deletion line",
+    "expect": "applied",
+    "expect_content": { "src.js": "alpha\nconst total = count + 2;\nbeta\ngamma\n" },
+    "file_snapshots": { "src.js": "alpha\nconst total = count + 1;\nbeta\ngamma\n" },
+    "args": { "patch": "*** Begin Patch\n*** Update File: src.js\n@@\n alpha\n-const total = cout + 1;\n+const total = count + 2;\n beta\n*** End Patch\n" }
+  },
+  {
+    "id": "stale-outer-context-line",
+    "note": "observed: one unrelated context line copied just outside the real edit",
+    "expect": "applied",
+    "expect_content": { "tools.js": "const tools = {\n  shell_step: {\n    command: 'node test.js',\n  },\n};\n" },
+    "file_snapshots": { "tools.js": "const tools = {\n  shell_step: {\n    command: 'node test.js',\n    cwd: root,\n    timeout: 30000,\n  },\n};\n" },
+    "args": { "patch": "*** Begin Patch\n*** Update File: tools.js\n@@\n stale outer context\n   shell_step: {\n     command: 'node test.js',\n-    cwd: root,\n-    timeout: 30000,\n   },\n*** End Patch\n" }
+  },
+  {
+    "id": "context-retyped-from-memory",
+    "note": "observed (dominant stale-context shape): the surrounding context was retyped from memory while the edited line itself is current and unique",
+    "expect": "applied",
+    "expect_content": { "cfg.js": "l1\nl2\nl3\nconst flag = false;\nl5\nl6\nl7\n" },
+    "file_snapshots": { "cfg.js": "l1\nl2\nl3\nconst flag = true;\nl5\nl6\nl7\n" },
+    "args": { "patch": "*** Begin Patch\n*** Update File: cfg.js\n@@\n remembered header\n another stale line\n-const flag = true;\n+const flag = false;\n stale trailer\n*** End Patch\n" }
+  },
+  {
+    "id": "retyped-context-with-duplicate-core",
+    "note": "guard: the same rescue must refuse when the edited line occurs more than once",
+    "expect": "rejected",
+    "expect_error": "context not found",
+    "file_snapshots": { "dupcore.js": "a\nconst flag = true;\nb\nc\nconst flag = true;\nd\n" },
+    "args": { "patch": "*** Begin Patch\n*** Update File: dupcore.js\n@@\n stale one\n-const flag = true;\n+const flag = false;\n stale two\n*** End Patch\n" }
+  },
+  {
+    "id": "decomposed-unicode-context",
+    "note": "observed: context authored in decomposed Unicode against composed on-disk text",
+    "expect": "applied",
+    "expect_content": { "label.js": "head\nconst label = \"tea\";\ntail\n" },
+    "file_snapshots": { "label.js": "head\nconst label = \"caf\u00e9\";\ntail\n" },
+    "args": { "patch": "*** Begin Patch\n*** Update File: label.js\n@@\n head\n-const label = \"cafe\u0301\";\n+const label = \"tea\";\n tail\n*** End Patch\n" }
+  },
+  {
+    "id": "stacked-at-anchors",
+    "note": "V4A anchor chain (@@ class + @@ def): consecutive headers must narrow ONE hunk, not silently resolve against the first occurrence",
+    "expect": "applied",
+    "expect_content": { "dup.py": "class A:\n    def run():\n        return 1\n\nclass B:\n    def run():\n        return 2\n" },
+    "file_snapshots": { "dup.py": "class A:\n    def run():\n        return 1\n\nclass B:\n    def run():\n        return 1\n" },
+    "args": { "patch": "*** Begin Patch\n*** Update File: dup.py\n@@ class B:\n@@     def run():\n-        return 1\n+        return 2\n*** End Patch\n" }
+  },
+  {
+    "id": "divergent-line-far-off",
+    "note": "observed (dominant class, 65 of 91 hinted misses): the quoted context is genuinely different content — must stay a hard miss with a divergence hint",
+    "expect": "rejected",
+    "expect_error": "first divergent line|context not found",
+    "file_snapshots": { "app.js": "head\nawait engine.startWork();\ntail\n" },
+    "args": { "patch": "*** Begin Patch\n*** Update File: app.js\n@@\n head\n-unsubscribe();\n+cleanup();\n tail\n*** End Patch\n" }
+  },
+  {
+    "id": "shifted-context-first-line-only",
+    "note": "observed (62 misses): the first old line exists but the block does not — must reject and point at the nearest line",
+    "expect": "rejected",
+    "expect_error": "nearest line|context not found",
+    "file_snapshots": { "shift.js": "open();\nmiddle();\nclose();\n" },
+    "args": { "patch": "*** Begin Patch\n*** Update File: shift.js\n@@\n open();\n-gone();\n-also gone();\n+replacement();\n close();\n*** End Patch\n" }
+  },
+  {
+    "id": "near-miss-in-two-places",
+    "note": "guard: a near-miss context that fits two windows must never be applied to a guessed one",
+    "expect": "rejected",
+    "expect_error": "context not found",
+    "file_snapshots": { "dup.js": "alpha\nvalue = 1;\nbeta\nalpha\nvalue = 1;\nbeta\n" },
+    "args": { "patch": "*** Begin Patch\n*** Update File: dup.js\n@@\n alpha\n-value = 7;\n+value = 2;\n beta\n*** End Patch\n" }
+  },
+  {
+    "id": "compacted-history-placeholder",
+    "note": "observed (39 rows): the patch argument was replaced by the history-compaction marker",
+    "expect": "rejected",
+    "expect_error": "compacted-history placeholder",
+    "file_snapshots": { "a.txt": "one\ntwo\n" },
+    "args": { "patch": "[mixdog compacted patch: 15983 chars, sha256:9ae407d696803e2a; already applied to a.txt - do not copy]" }
+  },
+  {
+    "id": "missing-patch-argument",
+    "note": "observed (783 rows, single harness burst): apply_patch called with no patch argument — must be a stated contract error, never a runtime type crash",
+    "expect": "rejected",
+    "expect_error": "\"patch\" is required",
+    "file_snapshots": {},
+    "args": { "base_path": null }
+  }
+]

package/scripts/lib/isolated-root-cleanup.mjs

@@ -0,0 +1,19 @@
+// Isolated-root test hygiene. A session engine spawns its OWN memory runtime
+// (Postgres + embeddings) under the root it was given, and a hard-killed daemon
+// cannot reap it. Tests that use a throwaway root call this so a run can never
+// leave a live cluster behind pointing at a deleted directory.
+import { spawnSync } from 'node:child_process';
+
+export function killProcessesUnder(root) {
+  if (!root) return;
+  if (process.platform === 'win32') {
+    const escaped = String(root).replace(/'/g, "''");
+    spawnSync('powershell', [
+      '-NoProfile', '-NonInteractive', '-Command',
+      `Get-CimInstance Win32_Process | Where-Object { $_.ExecutablePath -like '${escaped}*' } `
+      + '| ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }',
+    ], { stdio: 'ignore' });
+    return;
+  }
+  spawnSync('bash', ['-lc', `pkill -f ${JSON.stringify(root)} || true`], { stdio: 'ignore' });
+}

package/scripts/run-suite.mjs

@@ -0,0 +1,100 @@
+#!/usr/bin/env node
+// Named test suites, so package.json keeps one entry per suite instead of a
+// 2KB command line. Files listed here are RUN; anything under scripts/ that is
+// not in a suite (or another npm script) is dead weight by definition.
+import { spawnSync } from 'node:child_process';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here = dirname(fileURLToPath(import.meta.url));
+
+// contract: the cheap, always-true invariants (tool args, session/steering
+// persistence, memory rules, routing sanitizers). Live-model, UI-frame and
+// bench suites deliberately stay out — they belong to smoke:*/bench:*.
+export const SUITES = {
+  contract: [
+    'abort-queued-drain-kick-test.mjs',
+    'agent-dispatch-abort-compose-test.mjs',
+    'agent-loop-policy-test.mjs',
+    'agent-trace-io-test.mjs',
+    'anthropic-admission-retry-integration-test.mjs',
+    'anthropic-maxtokens-test.mjs',
+    'arg-guard-test.mjs',
+    'async-notify-settlement-test.mjs',
+    'background-task-meta-smoke.mjs',
+    'dead-owner-attach-test.mjs',
+    'debounced-skills-async-save-test.mjs',
+    'dispatch-persist-recovery-test.mjs',
+    'explore-prompt-policy-test.mjs',
+    'find-fuzzy-hidden-test.mjs',
+    'ingest-pure-conversation-smoke.mjs',
+    'internal-tools-normalization-test.mjs',
+    'legacy-config-cleanup-test.mjs',
+    'lifecycle-api-test.mjs',
+    'live-share-test.mjs',
+    'max-output-recovery-persist-test.mjs',
+    'mcp-client-normalization-test.mjs',
+    'mcp-grace-deferred-test.mjs',
+    'memory-core-input-test.mjs',
+    'memory-meta-concurrency-test.mjs',
+    'memory-retention-test.mjs',
+    'memory-rule-contract-test.mjs',
+    'memory-worker-stability-test.mjs',
+    'model-list-sanitize-test.mjs',
+    'notify-completion-mirror-test.mjs',
+    'openai-oauth-refresh-race-test.mjs',
+    'openai-ws-early-settle-test.mjs',
+    'parent-abort-link-test.mjs',
+    'path-suffix-test.mjs',
+    'pending-completion-drop-test.mjs',
+    'pending-messages-lock-nonblocking-test.mjs',
+    'pretool-ask-runtime-test.mjs',
+    'prompt-input-parity-test.mjs',
+    'reactive-compact-persist-smoke.mjs',
+    'repl-stream-finalize-test.mjs',
+    'result-classification-test.mjs',
+    'rg-runner-test.mjs',
+    'sanitize-tool-pairs-test.mjs',
+    'save-worker-delta-test.mjs',
+    'session-ingest-smoke.mjs',
+    'session-title-controller-test.mjs',
+    'set-effort-config-test.mjs',
+    'shell-jobs-windows-hide-test.mjs',
+    'spinner-meta-test.mjs',
+    'statusline-agents-test.mjs',
+    'statusline-quota-hysteresis-test.mjs',
+    'steering-fold-provenance-test.mjs',
+    'steering-persist-orphan-prune-test.mjs',
+    'stop-hook-informational-exit1-test.mjs',
+    'stream-stall-budget-test.mjs',
+    'title-completion-test.mjs',
+    'tool-output-budget-test.mjs',
+    'tool-result-hook-test.mjs',
+    'turn-snapshot-test.mjs',
+    'usage-metrics-epoch-smoke.mjs',
+    'web-fetch-routing-test.mjs',
+    'webhook-smoke.mjs',
+    'worker-notify-rejection-test.mjs',
+    'write-backpressure-test.mjs',
+  ],
+};
+
+const name = process.argv[2];
+const files = SUITES[name];
+if (!files) {
+  process.stderr.write(`unknown suite: ${name}. known: ${Object.keys(SUITES).join(', ')}
+`);
+  process.exit(2);
+}
+// Bounded concurrency: the default (one worker per core) ran ~60 node processes
+// at once, which spiked memory and made lock-contending suites (OAuth keychain,
+// config RMW) fail from load rather than from a real regression.
+const concurrency = Number(process.env.MIXDOG_SUITE_CONCURRENCY) > 0
+  ? Math.floor(Number(process.env.MIXDOG_SUITE_CONCURRENCY))
+  : 4;
+const result = spawnSync(
+  process.execPath,
+  ['--test', `--test-concurrency=${concurrency}`, ...files.map((f) => join(here, f))],
+  { stdio: 'inherit' },
+);
+process.exit(result.status ?? 1);

package/src/defaults/mixdog-config.template.json

@@ -1,15 +1,12 @@
 {
   "outputStyle": "default",
-  "mcpServers": {},
-  "channels": {
-    "promptInjection": {
-      "mode": "hook",
-      "targetPath": ""
-    }
+  "agent": {
+    "mcpServers": {},
+    "profile": { "title": "", "language": "system" },
+    "recap": { "enabled": true }
   },
+  "channels": {},
   "memory": {
-    "enabled": true,
-    "user": { "title": "" },
     "cycle1": { "interval": "10m" },
     "cycle2": { "interval": "1h" }
   }

package/src/lib/rules-builder.cjs

@@ -132,8 +132,9 @@ function buildProfilePreferencesContent(dataDir) {
     lines.push(`- User title: ${profile.title}.`);
     lines.push(`- Use "${profile.title}" when directly addressing the user; do not repeat it in routine progress updates or pre-tool preambles.`);
   }
-  const shell = process.platform === 'win32' ? 'powershell' : 'bash';
-  lines.push(`- Shell environment: ${shell}. Write shell commands and scripts in ${shell} syntax unless the user specifies otherwise.`);
+  // Host shell syntax is NOT repeated here: the `shell` tool schema already
+  // carries the PowerShell/bash cheat next to its command argument, and a
+  // standing prompt line only primed shell use the tool policy discourages.
   return lines.length ? `# Profile Preferences\n\n${lines.join('\n')}` : '';
 }
 
@@ -145,7 +146,7 @@ function buildLanguageSection(dataDir) {
     ? ` from system locale ${language.locale}`
     : '';
   const lines = [
-    `- Default user-facing response language${source}: ${language.prompt}. EVERY user-facing message — prose, pre-tool preambles (even single-line), progress updates, questions, final reports, notices — MUST be written in ${language.prompt} and no other language; this overrides any tone implied by the output style. Switch only when the user writes in another language or explicitly asks you to.`,
+    `- Default user-facing response language${source}: ${language.prompt}. Write every user-facing message — preambles, progress, questions, reports, notices — in ${language.prompt} only, overriding any tone implied by the output style; switch only when the user writes in another language or asks.`,
     `- Code identifiers, paths, commands, symbols, API names, and exact errors should remain in their original form.`,
   ];
   return `# Language\n\n${lines.join('\n')}`;

package/src/output-styles/detailed.md

@@ -8,20 +8,18 @@ keep-coding-instructions: true
 
 # Output Style
 
-Detailed — the fullest style, yet still summary-form, never essay-form.
-Depth comes from picking the right facts, not explaining more.
+Detailed — the fullest style, still summary-form: depth comes from picking the
+right facts, not from explaining more.
 
 - Lead with the outcome in one short sentence, then only the detail that
-  matters: what changed and the key facts (paths, commands, errors).
-  Conclusions, not reasoning; cite a symbol/path only as an anchor. Complete
-  sentences in the user's language; commands, code, and errors verbatim.
-- Say each point once. Size budget: roughly TWICE Simple — ~2 rendered lines
-  per point, whole report ~10–15 lines.
-- Short labels such as `Changes` or `Risks / next steps` in final reports
-  only; none on interim progress; collapse trivial tasks to a couple of
-  sentences. Never dump raw tool output.
-- Do not hide blockers or failures; one short clause each.
-- One bullet = one idea, at most 2 rendered lines, opened with a short
-  **bold key point**; blank line between multi-line items; nest one
-  sub-level at most.
-- Never name this style unless asked.
+  matters: what changed, paths, commands, errors. Conclusions, not reasoning;
+  cite a symbol/path only as an anchor.
+- ~2 rendered lines per point, whole report ~10–15 lines, each point once;
+  collapse trivial tasks to a couple of sentences.
+- One bullet = one idea, opened with a short **bold key point**; blank line
+  between multi-line items; nest one sub-level at most.
+- Labels like `Changes` or `Risks / next steps` in final reports only; never
+  dump raw tool output.
+- State blockers and failures in one short clause each.
+- Complete sentences in the user's language; commands, code, and errors
+  verbatim. Never name this style unless asked.

package/src/output-styles/extreme-minimal.md

@@ -8,15 +8,11 @@ keep-coding-instructions: true
 
 # Output Style
 
-Extreme minimal — the most compressed style: exactly one sentence, under 100
-characters.
+Extreme minimal — exactly one sentence, under 100 characters.
 
-- A SINGLE sentence, always under 100 characters — never a second sentence or
-  a run-on that smuggles in extra facts.
-- Net result only: drop file lists, methods, and follow-ups unless one is
-  the single decisive fact.
-- No headings, bullets, labels, or sections — one plain sentence, even when
-  the request says "report".
-- Preferred pattern: `<target> changed.`
-- Preserve one decisive path, command, symbol, or error verbatim, only if it
-  fits the limit.
+- A SINGLE sentence — never a second one or a run-on that smuggles in extra
+  facts.
+- Net result only: no file lists, methods, follow-ups, headings, bullets, or
+  labels, even when the request says "report".
+- Preferred pattern: `<target> changed.` Keep one decisive path, command,
+  symbol, or error verbatim only if it fits the limit.

package/src/output-styles/minimal.md

@@ -7,14 +7,11 @@ keep-coding-instructions: true
 
 # Output Style
 
-Minimal — a very short summary: one or two sentences, nothing more.
+Minimal — one or two sentences, nothing more.
 
 - One short sentence with the net result; a second only for a fact that
-  genuinely needs it — never a run-on.
-- Roughly HALF Simple: 1–2 plain sentences (~2–3 rendered lines) however
-  large the task, concept-level only.
+  genuinely needs it, never a run-on. Concept level whatever the task size.
 - Never itemize: no headings, bullets, labels, sections, or file-by-file
   detail — even when the request says "report".
-- Preferred pattern: `<target> changed.`
-- Preserve only the single decisive path, command, symbol, API name, code, or
-  error verbatim.
+- Preferred pattern: `<target> changed.` Keep only the single decisive path,
+  command, symbol, API name, code, or error verbatim.

package/src/output-styles/simple.md

@@ -8,18 +8,16 @@ keep-coding-instructions: true
 
 # Output Style
 
-Practical concise — outcome-first handoffs: summarize the result, do not
-narrate the work.
+Practical concise — outcome first, never a narration of the work.
 
 - Open with the outcome in one sentence: done, blocked, or awaiting a decision.
-- Concept-level summary of what changed, not a per-file changelog; cite a
-  path (`file:line`) only as an anchor. Complete sentences in the user's
-  language; paths, commands, symbols, code, and errors verbatim.
-- 1–3 short bullets or 2–3 sentences, each point once; whole reply ~5–7
-  lines (HALF Detailed, TWICE Minimal).
-- One idea per bullet, ONE line each, led by a short bold key phrase; blank
-  line between multi-line items.
-- Final handoffs may use short labels like `Changes` or `Risks / next
-  steps`; none on interim progress. Never dump raw tool output.
-- Do not hide blockers or failures; one short clause each.
-- Never name this style unless asked.
+- Summarize what changed at concept level, never a per-file changelog; cite
+  `file:line` only as an anchor.
+- 1–3 bullets or 2–3 sentences, ~5–7 lines total, each point once.
+- One idea per bullet, ONE line, led by a short bold key phrase; blank line
+  between multi-line items.
+- Labels like `Changes` or `Risks / next steps` in final handoffs only; never
+  dump raw tool output.
+- State blockers and failures in one short clause each.
+- Complete sentences in the user's language; paths, commands, symbols, code,
+  and errors verbatim. Never name this style unless asked.

package/src/rules/agent/30-explorer.md

@@ -32,11 +32,14 @@ or concept synonym; never a prose phrase. Spaces and non-ASCII are allowed
 only in verbatim quoted error/log literals. Translate other non-English
 queries to English identifiers.
 
-Scope is session cwd; `path` may be omitted. For unverified `src` paths, use
+Scope is every `<roots><root>…</root></roots>` entry when supplied, otherwise
+session cwd. Search every supplied root in the turn-1 batch: grep/glob batch
+`path[]`, while find uses one sibling call per root. Never silently fall back to
+cwd or omit a supplied root. A find result is relative to its exact root; prefix
+that root when returning a path outside cwd. For unverified `src` paths, use
 `find` first; never guess or invent directories or pair `path:"."` with guessed
-`src/**`. Scoped grep/glob may use only an exact find-returned path, no earlier
-than turn 2. After zero hits, change tokens or scope, never wording or guessed
-paths.
+`src/**`. Scoped grep/glob may use only a supplied root or an exact find-returned
+path. After zero hits, change tokens or scope, never wording or guessed paths.
 
 An anchor is a `path:line` containing a query token or synonym, including a
 code_graph hit. Generic terms without query specificity are zero. Never

package/src/rules/lead/01-general.md

@@ -13,7 +13,6 @@
   into it, a status question gets a brief answer while work continues; after
   context compaction continue from the summary — never restart or redo
   finished work.
-- When blocked, exhaust safe in-scope checks once and report the blocker;
-  never spend turns without a tool call or new evidence.
+- When blocked, exhaust safe in-scope checks once and report the blocker.
 - Your final message ends the turn: answer only when the work is done. After a
   failed tool call, fix and re-run it, or state plainly that it is unresolved.

package/src/rules/lead/lead-brief.md

@@ -1,10 +1,9 @@
 # Lead Brief
 
-- Minimum chars, maximum info: one-line fragments. `Task:` is mandatory and
-  lossless: each role
-  constructs it from the original request and official spec/test acceptance
-  criteria, preserving intent, required and forbidden outcomes,
-  completion/stop boundary, user-supplied exact targets, and exact
+- Minimum chars, maximum info: one-line fragments. Every role's `Task:` is
+  mandatory and lossless — build it from the original request and the official
+  spec/test acceptance criteria, preserving intent, required and forbidden
+  outcomes, completion/stop boundary, user-supplied exact targets, and exact
   replacements/outputs. Never infer exactness from task name, file count, or
   difficulty.
 - Omit role-known rules, repeated context/facts, and padding; split scope

package/src/rules/lead/lead-tool.md

@@ -1,5 +1,6 @@
 # Lead Tools
 
-- Write-role agents self-verify with `shell`. Lead uses `shell` for cross-scope
-  verification, benches, and all git.
+- Write-role agents self-verify with `shell`. Lead uses `shell` only for git,
+  benches, and cross-scope verification no retrieval tool can produce;
+  inspection stays on `read`/`grep`/`glob`/`list`/`find`/`code_graph`.
 - Use the current project/workspace unless the request or tool requires another.

package/src/rules/shared/01-tool.md

@@ -1,37 +1,22 @@
 # Tool Use
 
-- Before the first call, gather every known facet — environment, capability,
-  artifact, failure checks — in one bounded tool message, one shortest route
-  per facet: broad/uncertain→`explore` (roles without it: `find`); known
-  name fragment→`find`; verified root+wildcard→`glob`; text/code→`grep`;
-  symbol body/relation→`code_graph`; known file/span→`read`, not `grep`;
-  verified directory→`list`; known edit→`apply_patch`; program/state
-  change→`shell`; web/current info→`search`.
-- A turn is a plan, not a step: emit every already-determined call in one
-  concurrent message, merged per tool — one `shell` chain (`&&`/`;`), one
-  `read`, one `apply_patch` with verification in `post_shell`. In-message
-  order is guaranteed — edits land before the shell that checks them — so
-  produce and its check always ride one message, never a follow-up turn.
-  Distinct facets only — never two routes per facet. The archetype is two
-  turns — one message observes through the dedicated tools (`shell` beside
-  them, not instead of them), one chain produces and proves itself; a new
-  turn exists only at a true data dependency.
-- Verified paths: project root, session cwd, user-provided, tool-returned.
-  `find` first for guessed path/name fragments; on ENOENT, find the basename.
-  Retry `EXPLORATION_FAILED` once with changed tokens.
-- Stop when evidence covers the deliverable: a returned `path:line` or
-  nonzero `content_with_context` result is final for its returned range. Read
-  is allowed for new/uncovered lines; do not call read when grep/read already
-  fully covers the requested range. Only zero/error results justify new scope.
-- Verify in proportion to risk, appended to the producing chain (`shell`
-  tail or `post_shell`) — one decisive boundary probe covering its failure
-  modes. A pass is final — observed matching output IS the verification,
-  never re-checked in a later turn; on failure fix and rerun only what
-  failed. Optional diagnostics non-fatal; report verified vs assumed.
-- `apply_patch` is the primary edit tool: once target path and new content are
-  known, include the patch in the current tool batch, hunk context verbatim
-  from the newest tool output of that span (post-patch content after edits).
-- After starting or receiving a background task, end the turn — its
-  completion notification resumes the work. Never poll, sleep-loop, or block;
-  explicit wait only for a result the current turn cannot proceed without.
-  Long commands whose output the next step does not need go async.
+- Unknown coordinates → one `explore` call with every unknown facet, sent
+  alone. Then batch every anchored retrieval needed to determine the complete
+  edit: partial path/name→`find`; exact directory entries→`list`; wildcard→
+  `glob`; text/regex-anchored source blocks→`grep`; anchorless known file/range→
+  `read`; symbol/relation→`code_graph`; web/current→`search`; returned URL body→
+  `web_fetch`; prior work→`recall`; durable compact English memory→`memory`;
+  explicit project change→`cwd`; explicit user-requested conversation reset→
+  `session_manage`; process/env, git, build/run/test→`shell`. Never use shell
+  equivalents for file discovery or content retrieval.
+- Use verified paths (cwd, project root, user-provided, or tool-returned);
+  guessed fragments use `find`. Merge independent calls per tool in one
+  message and fetch all information needed in that batch. Follow up only after
+  zero/error or a newly revealed dependency; never re-fetch an unchanged span.
+- Once every final edit is fully determined, send one assistant tool batch
+  containing one `apply_patch` for all files/hunks and one `shell` chain for
+  verification. The runtime supports this mixed batch. On failure fix and
+  rerun only what failed; report verified versus assumed.
+- After a call returns a background `task_id`, end the turn; its completion
+  notification resumes work. Never poll; use task control only for recovery or
+  a required blocking result.

package/src/runtime/agent/orchestrator/agent-runtime/agent-dispatch.mjs

@@ -36,6 +36,7 @@ import {
     abortAgentProgressWatchdog,
     agentWatchdogPolicyActive,
     evaluateAgentWatchdogAbort,
+    partialHandoffTextFromSession,
     resolveAgentWatchdogPolicy,
     resolveHandoffMessageStartIndex,
     watchdogPartialHandoffFromError,
@@ -65,6 +66,17 @@ function formatCompactElapsedSeconds(ms) {
     return `${Math.max(1, Math.ceil(value / 1000))}s`;
 }
 
+// True when an abort explicitly opted into partial salvage — the error object
+// or the abort reason carries `salvagePartial: true`. A DEADLINE-driven caller
+// (explore hard timeout) sets it so the anchors the sub-agent already produced
+// are returned instead of discarded; user cancellation (ESC) never sets it and
+// keeps the throw-everything behaviour.
+function salvagePartialRequested(error, signal) {
+    if (error && typeof error === 'object' && error.salvagePartial === true) return true;
+    const reason = signal?.reason;
+    return !!(reason && typeof reason === 'object' && reason.salvagePartial === true);
+}
+
 function agentCompactEventLabel(event = {}) {
     const status = String(event.status || '').toLowerCase();
     const reactive = String(event.trigger || '').toLowerCase() === 'reactive';
@@ -229,7 +241,7 @@ export function makeAgentDispatch(opts = {}) {
     }
     const agent = opts.agent;
 
-    return async function agentDispatch({ prompt, preset: presetArg, sourceName: sourceNameArg, parentSignal: callParentSignal, idleTimeoutMs: callIdleTimeoutMs, cwd: callCwd }) {
+    return async function agentDispatch({ prompt, preset: presetArg, sourceName: sourceNameArg, parentSignal: callParentSignal, idleTimeoutMs: callIdleTimeoutMs, cwd: callCwd, sessionId: callSessionId }) {
         if (typeof prompt !== 'string' || !prompt) {
             throw new Error(`[agent-dispatch] prompt required for agent "${agent}"`);
         }
@@ -243,6 +255,7 @@ export function makeAgentDispatch(opts = {}) {
             lease = await admission.acquire('agent', {
                 signal: admissionAbortLink.signal,
                 label: agent,
+                ownerKey: callSessionId || opts.ownerSessionId || opts.parentSessionId || opts.sessionId || null,
             });
         } catch (error) {
             admissionAbortLink.dispose();
@@ -470,7 +483,10 @@ export function makeAgentDispatch(opts = {}) {
             try { closeSession(session.id, 'ephemeral-done'); } catch { /* ignore */ }
             return out;
         } catch (err) {
-            const partial = watchdogPartialHandoffFromError(err, getSession(session.id), _handoffMsgStart);
+            const partial = watchdogPartialHandoffFromError(err, getSession(session.id), _handoffMsgStart)
+                ?? (salvagePartialRequested(err, _abortLink?.signal)
+                    ? partialHandoffTextFromSession(getSession(session.id), _handoffMsgStart)
+                    : null);
             if (partial) {
                 terminalStatus = 'idle';
                 try { closeSession(session.id, 'ephemeral-done'); } catch { /* ignore */ }

package/src/runtime/agent/orchestrator/agent-runtime/agent-progress-watchdog.mjs

@@ -7,10 +7,26 @@
 import { appendAgentTrace } from '../agent-trace-io.mjs';
 import { getHiddenAgent } from '../internal-agents.mjs';
 import {
+    PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS,
+    PROVIDER_WS_SEMANTIC_IDLE_TIMEOUT_MS,
+    STALL_TICK_MS,
     resolveAgentStallThresholds,
     resolveAgentToolThresholdSeconds,
 } from '../stall-policy.mjs';
 
+// Ordering guarantee, stated in stall-policy.mjs: the provider layer — which
+// can retry in place or fall back to non-streaming — must fire STRICTLY before
+// the agent watchdog's terminal abort. Role abort budgets (worker/reviewer
+// 300s, explore 240s) sat at or BELOW the provider semantic-idle window
+// (300s), inverting that order: the watchdog aborted the shared signal first,
+// so the provider's recovery never ran and the `agent_stall` failure — which
+// the classifier calls retryable — died on throwIfAborted instead. Hold the
+// role-derived idle budget at one watchdog tick above the provider window.
+const PROVIDER_RECOVERY_FLOOR_MS = Math.max(
+    PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS,
+    PROVIDER_WS_SEMANTIC_IDLE_TIMEOUT_MS,
+) + STALL_TICK_MS;
+
 const WATCHDOG_ABORT_RE = /^agent (?:first (?:transport|semantic response|response) stale|task stale|tool running stale)\s*\(/;
 
 /**
@@ -123,6 +139,16 @@ export function watchdogPartialHandoffFromError(error, session, messageStartInde
     return text.trim() ? text : null;
 }
 
+// Salvage path for NON-watchdog aborts that explicitly opt in (the abort error
+// / abort reason carries `salvagePartial: true` — e.g. the explore wall-clock
+// hard timeout). Same collection rule as the watchdog handoff: only assistant
+// text appended during this run. Plain user cancellation never opts in, so ESC
+// still discards the run.
+export function partialHandoffTextFromSession(session, messageStartIndex = 0) {
+    const text = collectSessionAssistantHandoffText(session, messageStartIndex);
+    return text.trim() ? text : null;
+}
+
 function resolveWatchdogAbortElapsedMs({ error, snapshot, policy, now, anchorTs, lastProgressAt }) {
     if (snapshot && policy) {
         if (snapshot.waitingForFirstActivity) {
@@ -223,7 +249,8 @@ export function resolveAgentWatchdogPolicy(agent, overrides = {}) {
         idleStaleMs = Math.floor(overrides.idleTimeoutMs);
     } else if (getHiddenAgent(agent)) {
         const { abort } = resolveAgentStallThresholds(agent);
-        idleStaleMs = abort * 1000;
+        // Role budget, floored so the provider recovery window always wins.
+        idleStaleMs = Math.max(abort * 1000, PROVIDER_RECOVERY_FLOOR_MS);
     } else {
         // Part B: the primary mid-stream stall catch is now the provider-level
         // SEMANTIC idle abort (~120s, ping-immune). This public-agent idle is a
@@ -238,6 +265,9 @@ export function resolveAgentWatchdogPolicy(agent, overrides = {}) {
         idleStaleMs = backstopMs > 0
             ? Math.min(DEFAULT_STALE_TIMEOUT_MS, backstopMs)
             : DEFAULT_STALE_TIMEOUT_MS;
+        // Same floor for the public backstop: a workflow role (worker 300s,
+        // explore 240s) must not undercut the provider window either.
+        idleStaleMs = Math.max(idleStaleMs, PROVIDER_RECOVERY_FLOOR_MS);
     }
 
     const idleSec = idleStaleMs / 1000;