mixdog 0.9.95 → 0.9.97

package/src/standalone/{backend-daemon.mjs → daemon.mjs}

@@ -1,25 +1,22 @@
-// Machine-global BACKEND daemon entry — the single mixdog backend process.
+// Machine-global Mixdog daemon entry — one process for sessions, channels, and memory.
 //
-// One process per machine hosts the whole backend: the channels runtime
-// (worker-main), the memory runtime, and the session ENGINE pool. It exposes
-// two local front doors — channel-daemon-transport.mjs (pointer-routed channel
-// calls) and engine-daemon-transport.mjs (broadcast engine frames) — so the
+// One process per machine hosts the whole service: the channels runtime
+// (worker-main), the memory runtime, and the session runtime pool. It exposes
+// two local front doors — channel transport (pointer-routed calls) and session
+// transport (broadcast session frames) — so the
 // terminal TUI and the desktop app are views over ONE writer instead of each
-// booting its own engine and arbitrating ownership on disk.
+// booting a separate service and arbitrating ownership on disk.
 // Spawned (or attached-to) by createStandaloneChannelWorker; ownership is a
 // pid-verified singleton lock (singleton-owner.mjs) — NOT the try-once
 // active-instance lock that starved under 6 contending workers. A stale daemon
 // (dead owner pid) is reclaimed by the next claim; a live peer that wins the
 // race makes this process exit(0) so the spawner attaches to the winner.
 //
-// Boot order matters: MIXDOG_CHANNEL_DAEMON must be set BEFORE importing the
-// channels runtime so worker-main skips its parent-IPC loop (runWorkerIpc) and
-// lets this entry own start()/stop() + the transport.
-process.env.MIXDOG_CHANNEL_DAEMON = '1';
+// The unified host identity is set before the channels runtime is loaded so
+// worker-main skips its parent-IPC loop and this entry owns start()/stop().
 process.env.MIXDOG_WORKER_MODE = process.env.MIXDOG_WORKER_MODE || '1';
-// This process IS the engine host: its own createEngineSession() must build
-// REAL engines, never a proxy back into itself.
-process.env.MIXDOG_ENGINE_DAEMON_HOST = '1';
+// This process owns session runtimes and must never proxy back into itself.
+process.env.MIXDOG_DAEMON_HOST = '1';
 
 // V8 compile cache: the daemon is a standalone child entry (not via cli.mjs);
 // caching compiled bytecode across restarts removes the channels+memory
@@ -31,21 +28,46 @@ try {
 
 import os from 'node:os';
 import path from 'node:path';
-import { mkdirSync } from 'node:fs';
+import { mkdirSync, rmSync } from 'node:fs';
 import { appendFile, mkdir, open, stat, writeFile } from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
 import { monitorEventLoopDelay, performance } from 'node:perf_hooks';
 import { inspect } from 'node:util';
+import { writeJsonAtomicSync } from '../runtime/shared/atomic-file.mjs';
+import { ensureProcessListenerHeadroom } from '../runtime/shared/process-listener-headroom.mjs';
 import { claimSingletonOwner, releaseSingletonOwner } from '../runtime/shared/singleton-owner.mjs';
 import { PLUGIN_LOG_MAX_BYTES, PLUGIN_LOG_KEEP_BYTES } from '../lib/mixdog-debug.cjs';
 import { setChannelNotifySink } from '../runtime/channels/lib/parent-bridge.mjs';
 import { setOwnerContext } from '../runtime/channels/lib/runtime-paths.mjs';
 import { safeIpcSend } from '../runtime/shared/safe-ipc-send.mjs';
-import { createChannelDaemonTransport } from './channel-daemon-transport.mjs';
-import { installEngineDaemonLocalBridge } from './engine-daemon-local-bridge.mjs';
-import { createEngineDaemonTransport } from './engine-daemon-transport.mjs';
-import { createEngineDaemonService } from './engine-daemon-service.mjs';
-import { createStandaloneMemoryRuntime } from './memory-runtime-proxy.mjs';
+import { resourceAdmission } from '../runtime/shared/resource-admission.mjs';
+import { snapshot as childSpawnSnapshot } from '../runtime/shared/child-spawn-gate.mjs';
+import { toolWorkloadSnapshot } from '../runtime/shared/tool-workload-gates.mjs';
+import { providerAdmissionScheduler } from '../runtime/agent/orchestrator/providers/admission-scheduler.mjs';
+import { getMcpAdmissionSnapshot } from '../runtime/agent/orchestrator/mcp/client.mjs';
+import { loadConfig as loadAgentConfig } from '../runtime/agent/orchestrator/config.mjs';
+import { initProviders } from '../runtime/agent/orchestrator/providers/registry.mjs';
+import { makeAgentDispatch } from '../runtime/agent/orchestrator/agent-runtime/agent-dispatch.mjs';
+import {
+  closeProviderStreamJsonPool,
+  providerStreamJsonSnapshot,
+} from '../runtime/agent/orchestrator/providers/stream-json-pool.mjs';
+import { createAgentDispatchBroker } from './agent-dispatch-broker.mjs';
+import { createChannelTransport } from './channel-transport.mjs';
+import { createSessionTransport } from './session-transport.mjs';
+import { createSessionService } from './session-service.mjs';
+import { createSessionProtocolClient } from './session-protocol.mjs';
+import { createSessionRuntimePool } from './session-runtime-pool.mjs';
+import { getStandaloneMemoryRuntime } from './memory-runtime-proxy.mjs';
+import {
+  compareRuntimeVersions,
+  SESSION_CAPABILITY_FINGERPRINT,
+  SESSION_PROTOCOL,
+  SESSION_REVISION,
+  runtimeVersion,
+} from './session-wire.mjs';
+
+ensureProcessListenerHeadroom(64);
 
 function runtimeRoot() {
   return process.env.MIXDOG_RUNTIME_ROOT
@@ -54,28 +76,21 @@ function runtimeRoot() {
 }
 
 const RUNTIME_ROOT = runtimeRoot();
-const DATA_DIR = process.env.MIXDOG_DATA_DIR ? path.resolve(process.env.MIXDOG_DATA_DIR) : RUNTIME_ROOT;
+const DATA_DIR = process.env.MIXDOG_DATA_DIR
+  ? path.resolve(process.env.MIXDOG_DATA_DIR)
+  : path.join(process.env.MIXDOG_HOME || path.join(os.homedir(), '.mixdog'), 'data');
+process.env.MIXDOG_DATA_DIR = DATA_DIR;
+process.env.MIXDOG_SERVER_PID = String(process.pid);
 const CWD = process.cwd();
-const DISCOVERY_PATH = path.join(RUNTIME_ROOT, 'channel-daemon.json');
-// Engine views discover the SAME process through their own endpoint: one
-// daemon, two front doors (channel routing is pointer-targeted, engine frames
-// are broadcast — they must not share a router).
-const ENGINE_DISCOVERY_PATH = path.join(RUNTIME_ROOT, 'engine-daemon.json');
-// Owner-election lock, separate from the channels seat/bridge state. Reused
-// pid-verified claim primitive with real claim-lock retry inside.
-const OWNER_PATH = path.join(DATA_DIR, 'channel-daemon-owner.json');
-// Memory runtime is folded into the daemon: the ONE machine-global process is
-// responsible for starting BOTH the channels runtime and the memory runtime.
-// The memory proxy is spawn-or-attach + singleton (memory-runtime-owner lock)
-// and advertises memory_port to active-instance.json exactly as before, so
-// external readers / memory-client.mjs discovery is UNCHANGED.
+const DAEMON_DISCOVERY_PATH = path.join(RUNTIME_ROOT, 'daemon.json');
+// Owner-election lock, separate from the channels seat/bridge state.
+const OWNER_PATH = path.join(DATA_DIR, 'daemon-owner.json');
 const MEMORY_ENTRY = fileURLToPath(new URL('../runtime/memory/index.mjs', import.meta.url));
-
 // The spawning TUI mirrors our stderr into this file ONLY until it sees our
 // 'ready' message; after that its pipe consumer dies on parent exit and later
 // lines would be lost. So once ready we append here ourselves (fileLogging on),
 // keyed to the SAME ready event the spawner detaches on — no loss, no dup.
-const LOG_PATH = path.join(DATA_DIR, 'channels-worker-standalone.log');
+const LOG_PATH = path.join(DATA_DIR, 'daemon.log');
 let fileLogging = false;
 // This process outlives every spawner, so it has to bound its OWN log: the
 // spawner's boot-time rotate never runs again while the daemon lives, and the
@@ -87,6 +102,7 @@ let logQueueBytes = 0;
 let logDropped = 0;
 let logFlushTimer = null;
 let logWriter = Promise.resolve();
+let logFileBytes = null;
 
 function boundedLogText(value) {
   const text = String(value ?? '');
@@ -95,15 +111,18 @@ function boundedLogText(value) {
 }
 
 async function rotateDaemonLogIfNeeded(incomingBytes) {
-  let info;
-  try { info = await stat(LOG_PATH); } catch { return; }
-  if (info.size + incomingBytes <= PLUGIN_LOG_MAX_BYTES) return;
-  const keep = Math.min(info.size, PLUGIN_LOG_KEEP_BYTES);
+  if (logFileBytes === null) {
+    try { logFileBytes = (await stat(LOG_PATH)).size; }
+    catch { logFileBytes = 0; }
+  }
+  if (logFileBytes + incomingBytes <= PLUGIN_LOG_MAX_BYTES) return;
+  const keep = Math.min(logFileBytes, PLUGIN_LOG_KEEP_BYTES);
   const tail = Buffer.allocUnsafe(keep);
   const handle = await open(LOG_PATH, 'r');
   try {
-    const { bytesRead } = await handle.read(tail, 0, keep, Math.max(0, info.size - keep));
+    const { bytesRead } = await handle.read(tail, 0, keep, Math.max(0, logFileBytes - keep));
     await writeFile(LOG_PATH, tail.subarray(0, bytesRead));
+    logFileBytes = bytesRead;
   } finally {
     await handle.close().catch(() => {});
   }
@@ -117,7 +136,7 @@ function takeLogBatch() {
   logQueueBytes = 0;
   logDropped = 0;
   if (dropped > 0) {
-    rows.unshift(`[${new Date().toISOString()}] [backend-daemon] dropped ${dropped} log line(s) under backpressure\n`);
+    rows.unshift(`[${new Date().toISOString()}] [daemon] dropped ${dropped} log line(s) under backpressure\n`);
   }
   return rows.join('');
 }
@@ -132,6 +151,7 @@ function queueLogFlush(delayMs = 10) {
       await mkdir(path.dirname(LOG_PATH), { recursive: true });
       await rotateDaemonLogIfNeeded(Buffer.byteLength(batch));
       await appendFile(LOG_PATH, batch, 'utf8');
+      logFileBytes = (logFileBytes || 0) + Buffer.byteLength(batch);
     }).catch(() => {});
     if (logQueue.length > 0 || logDropped > 0) queueLogFlush();
   }, delayMs);
@@ -162,12 +182,13 @@ async function flushDaemonLogs() {
       await mkdir(path.dirname(LOG_PATH), { recursive: true });
       await rotateDaemonLogIfNeeded(Buffer.byteLength(batch));
       await appendFile(LOG_PATH, batch, 'utf8');
+      logFileBytes = (logFileBytes || 0) + Buffer.byteLength(batch);
     }).catch(() => {});
   }
   await logWriter;
 }
 function log(line) {
-  const text = `[backend-daemon] ${line}`;
+  const text = `[daemon] ${line}`;
   // Exactly ONE sink per line: before ready the spawner mirrors our stderr into
   // the log, so write stderr only; after ready we own the file, so write the
   // file only — never both (no duplicate around the ready handoff).
@@ -213,13 +234,15 @@ function installDaemonLogRedirect() {
 
 let channels = null;
 let transport = null;
-let engineTransport = null;
-let engineService = null;
-let localEngineBridge = null;
-let uninstallLocalEngineBridge = null;
+let sessionTransport = null;
+let sessionService = null;
+let sessionRuntimePool = null;
+let localSessionBridge = null;
 let memoryRuntime = null;
+let agentDispatchBroker = null;
 let shuttingDown = false;
 let shutdownRecheckTimer = null;
+let replacementRequested = null;
 const eventLoopDelay = monitorEventLoopDelay({ resolution: 20 });
 eventLoopDelay.enable();
 let eventLoopLagTimer = null;
@@ -242,45 +265,68 @@ async function shutdown(reason, code = 0) {
   }
   log(`shutting down (${reason})`);
   try { setChannelNotifySink(null); } catch {}
-  try { await engineService?.stop?.(reason); } catch (e) { log(`engine.stop failed: ${e?.message || e}`); }
-  try { await localEngineBridge?.close?.(reason); } catch (e) { log(`local engine bridge.close failed: ${e?.message || e}`); }
-  try { uninstallLocalEngineBridge?.(); } catch {}
-  uninstallLocalEngineBridge = null;
-  try { await engineTransport?.stop?.(); } catch (e) { log(`engine transport.stop failed: ${e?.message || e}`); }
+  try { await sessionService?.stop?.(reason); } catch (e) { log(`session service stop failed: ${e?.message || e}`); }
+  try { await sessionRuntimePool?.close?.(reason); } catch (e) { log(`session shard pool stop failed: ${e?.message || e}`); }
+  try { await localSessionBridge?.close?.(reason); } catch (e) { log(`local session bridge.close failed: ${e?.message || e}`); }
+  try { await sessionTransport?.stop?.(); } catch (e) { log(`session transport stop failed: ${e?.message || e}`); }
   try { await channels?.stop?.(); } catch (e) { log(`channels.stop failed: ${e?.message || e}`); }
-  // Detach the memory client (never hard-kills the shared memory daemon).
+  // The daemon only releases its client registration. The isolated memory
+  // process shuts down after its last live client disappears.
   try { await memoryRuntime?.stop?.(); } catch (e) { log(`memory.stop failed: ${e?.message || e}`); }
+  try { agentDispatchBroker?.close?.(reason); } catch (e) { log(`agent broker stop failed: ${e?.message || e}`); }
+  try { await closeProviderStreamJsonPool(reason); } catch (e) { log(`stream parser stop failed: ${e?.message || e}`); }
   try { await transport?.stop?.(); } catch (e) { log(`transport.stop failed: ${e?.message || e}`); }
   if (eventLoopLagTimer) { clearInterval(eventLoopLagTimer); eventLoopLagTimer = null; }
   eventLoopDelay.disable();
+  for (const discoveryPath of [DAEMON_DISCOVERY_PATH]) {
+    try { rmSync(discoveryPath, { force: true }); } catch {}
+  }
   try { releaseSingletonOwner(OWNER_PATH, process.pid); } catch {}
   await flushDaemonLogs();
   process.exit(code);
 }
 
-/** One process, two front doors (channels + engines): an idle side must never
+/** One process, two front doors (channels + sessions): an idle side must never
  *  evict a busy one, so every self-shutdown trigger checks BOTH registries. */
 function maybeSelfShutdown(reason) {
   const channelClients = transport?.clientCount ?? 0;
-  const engineClients = engineTransport?.clientCount ?? 0;
-  const remoteClients = engineService?.externalClientCount ?? 0;
-  if (channelClients > 0 || engineClients > 0 || remoteClients > 0) {
+  const sessionClients = sessionTransport?.clientCount ?? 0;
+  const remoteClients = sessionService?.externalClientCount ?? 0;
+  const replacing = Boolean(replacementRequested);
+  if (channelClients > 0 || sessionClients > 0 || (!replacing && remoteClients > 0)) {
     if (shutdownRecheckTimer) {
       clearTimeout(shutdownRecheckTimer);
       shutdownRecheckTimer = null;
     }
-    log(`shutdown deferred (${reason}): channels=${channelClients} engines=${engineClients} remote=${remoteClients}`);
+    log(`shutdown deferred (${reason}): channels=${channelClients} sessionClients=${sessionClients} remote=${remoteClients}`);
+    return;
+  }
+  const activeCalls = (transport?.activeCount ?? 0) + (sessionTransport?.activeCount ?? 0);
+  const queuedCalls = (transport?.queuedCount ?? 0) + (sessionTransport?.queuedCount ?? 0);
+  if (activeCalls > 0 || queuedCalls > 0) {
+    log(`shutdown deferred (${reason}): activeCalls=${activeCalls} queuedCalls=${queuedCalls}`);
+    if (!shutdownRecheckTimer) {
+      shutdownRecheckTimer = setTimeout(() => {
+        shutdownRecheckTimer = null;
+        maybeSelfShutdown('service calls settled');
+      }, 250);
+      shutdownRecheckTimer.unref?.();
+    }
     return;
   }
   // A turn in flight outlives every view — closing the app or the terminal is
   // not a reason to abandon work the daemon is still running.
-  const busyEngines = engineService?.busyCount ?? 0;
-  if (busyEngines > 0) {
-    log(`shutdown deferred (${reason}): ${busyEngines} engine(s) still working`);
+  const busySessions = sessionService?.busyCount ?? 0;
+  const busyMemoryAgents = agentDispatchBroker?.snapshot?.().inFlight ?? 0;
+  if (busySessions > 0 || busyMemoryAgents > 0) {
+    log(
+      `shutdown deferred (${reason}): busySessions=${busySessions}`
+      + ` memoryAgents=${busyMemoryAgents}`,
+    );
     if (!shutdownRecheckTimer) {
       shutdownRecheckTimer = setTimeout(() => {
         shutdownRecheckTimer = null;
-        maybeSelfShutdown('busy engines settled');
+        maybeSelfShutdown('busy service work settled');
       }, 1_000);
       shutdownRecheckTimer.unref?.();
     }
@@ -289,6 +335,30 @@ function maybeSelfShutdown(reason) {
   void shutdown(reason);
 }
 
+function requestDaemonReplacement({ protocol, revision, version } = {}) {
+  const requested = {
+    protocol: Number(protocol),
+    revision: Math.max(0, Number(revision) || 0),
+    version: String(version || '0.0.0'),
+  };
+  if (requested.protocol !== SESSION_PROTOCOL) return false;
+  const revisionOrder = requested.revision - SESSION_REVISION;
+  const versionOrder = compareRuntimeVersions(requested.version, runtimeVersion());
+  if (revisionOrder < 0 || (revisionOrder === 0 && versionOrder <= 0)) return false;
+  if (
+    replacementRequested
+    && requested.revision === replacementRequested.revision
+    && requested.version === replacementRequested.version
+  ) return true;
+  replacementRequested = requested;
+  const reason = `daemon replacement by revision/build ${requested.revision}/${requested.version}`;
+  log(`${reason} requested — draining clients without interrupting live work`);
+  sessionTransport?.beginDrain?.(reason);
+  transport?.beginDrain?.(reason);
+  maybeSelfShutdown(reason);
+  return true;
+}
+
 async function main() {
   const startedAt = performance.now();
   // 0o700 matters where the runtime root is a SHARED temp dir: the discovery
@@ -299,12 +369,28 @@ async function main() {
   // Pid-verified singleton claim (claimSingletonOwner reclaims a dead-pid owner
   // file and refuses only a LIVE peer). Loser exits so the spawner attaches to
   // the winner instead of running a second daemon.
-  const claim = claimSingletonOwner(OWNER_PATH, { kind: 'channel-runtime-daemon', pid: process.pid, meta: { cwd: CWD } });
+  const claim = claimSingletonOwner(OWNER_PATH, {
+    kind: 'mixdog-daemon',
+    pid: process.pid,
+    meta: {
+      cwd: CWD,
+      protocol: SESSION_PROTOCOL,
+      revision: SESSION_REVISION,
+      version: runtimeVersion(),
+    },
+  });
   if (!claim.owned) {
     log(`live peer holds owner lock (pid=${claim.owner?.pid}) — exiting for attach`);
     process.exit(0);
   }
   process.on('exit', () => { try { releaseSingletonOwner(OWNER_PATH, process.pid); } catch {} });
+  agentDispatchBroker = createAgentDispatchBroker({
+    loadConfig: loadAgentConfig,
+    initProviders,
+    makeAgentDispatch,
+    log,
+    onActivityChanged: () => { maybeSelfShutdown('memory agent activity changed'); },
+  });
   process.on('mixdog:turn-timing', (row = {}) => {
     const ms = (value) => Number.isFinite(value) ? Math.round(value) : -1;
     log(
@@ -318,7 +404,7 @@ async function main() {
 
   // The channels runtime is imported AFTER the daemon env is set so worker-main
   // skips runWorkerIpc; that import also triggers its boot side effects
-  // (config/backend). It is now deferred past the ready handshake: an engine
+  // (config/service). It is now deferred past the ready handshake: a session
   // view attaching to this same process must not wait out the channels graph,
   // and every channels call awaits this promise anyway.
   let channelsReady = null;
@@ -333,9 +419,9 @@ async function main() {
   }
 
   // Channels bring automation with them (schedules, webhook listener + tunnel,
-  // optional messaging backend). A daemon spawned by a TUI starts them exactly
-  // as before; a daemon spawned for ENGINE views stays dormant until a channels
-  // client actually registers, so an app-only backend runs no tunnels.
+  // optional messaging service). A daemon spawned by a TUI starts them exactly
+  // as before; a daemon spawned for session views stays dormant until a channels
+  // client actually registers, so an app-only service runs no tunnels.
   let channelsStarted = false;
   function startChannels() {
     if (channelsStarted) return;
@@ -355,79 +441,77 @@ async function main() {
     }
     return module.handleToolCallWithBridgeRetry(name, args || {});
   };
-  transport = createChannelDaemonTransport({
+  transport = createChannelTransport({
     handleCall,
-    // If a manual owner disappears without sending OFF, deactivate the backend.
+    agentBroker: agentDispatchBroker,
+    remoteStatePath: path.join(RUNTIME_ROOT, 'channel-remote-state.json'),
+    remoteIntentPath: path.join(RUNTIME_ROOT, 'channel-remote-intent.json'),
+    // If a manual owner disappears without sending OFF, deactivate the service.
     // No survivor is selected or rebound.
     dispatchControl: (name, args, ctx) => handleCall(name, args, ctx),
-    discoveryPath: DISCOVERY_PATH,
     log,
     // Self-shutdown when the last attached TUI leaves (reuses the SSE/client
-    // registry as the liveness signal — mirrors the memory daemon grace).
+    // registry as the liveness signal).
     onClientsEmpty: () => { maybeSelfShutdown('no live channel clients'); },
     // First channels client in: bring the channels runtime up (see startChannels).
     onClientRegistered: () => { startChannels(); },
   });
   setChannelNotifySink((method, params) => transport.notify(method, params));
   const { port, token } = await transport.start();
+  // Memory-cycle agent dispatch is rare and initializes on first use. Eagerly
+  // loading its provider graph here consumed the control loop before any
+  // memory cycle requested it.
 
-  // ── Engine front door ───────────────────────────────────────────────────────
-  // Session engines live in THIS process too, so the terminal TUI and the
-  // desktop app share ONE writer instead of arbitrating ownership on disk. The
-  // engine module is the whole runtime graph, so it is imported when the first
-  // engine client registers — early enough to overlap user think time, while a
-  // channels-only spawn still never pays for it.
-  const localEngineClients = new Map();
-  let nextLocalEngineClient = 0;
-  localEngineBridge = {
+  // ── Session front door ──────────────────────────────────────────────────────
+  // Session runtimes live in child-process shards. The daemon owns routing and
+  // fan-out only, so one provider/parser turn cannot stall health or input for
+  // every other session.
+  const localSessionClients = new Map();
+  let nextLocalSessionClient = 0;
+  localSessionBridge = {
     attach({ onFrame = () => {}, onFatal = () => {} } = {}) {
-      const clientToken = `daemon_local_${process.pid}_${++nextLocalEngineClient}`;
+      const clientToken = `daemon_local_${process.pid}_${++nextLocalSessionClient}`;
       let closed = false;
-      localEngineClients.set(clientToken, { onFrame, onFatal });
-      return {
+      localSessionClients.set(clientToken, { onFrame, onFatal });
+      return createSessionProtocolClient({
         call(name, args = {}, options = {}) {
-          if (closed) throw new Error('engine daemon local bridge is closed');
-          return engineService.handleCall(name, args, {
+          if (closed) throw new Error('daemon-local session client is closed');
+          return sessionService.handleCall(name, args, {
             clientToken,
             ...(options?.callId ? { callId: String(options.callId) } : {}),
           });
         },
-        async close(reason = 'local engine view closed') {
+        async close(reason = 'local session view closed') {
           if (closed) return;
           closed = true;
-          localEngineClients.delete(clientToken);
-          try { engineService.releaseClient(clientToken); } catch {}
+          localSessionClients.delete(clientToken);
+          try { sessionService.releaseClient(clientToken); } catch {}
           log(`${reason} (${clientToken})`);
         },
-      };
+      });
     },
     publish(frame, targetTokens = null) {
       const targets = targetTokens ? new Set(targetTokens) : null;
-      for (const [clientToken, client] of localEngineClients) {
+      for (const [clientToken, client] of localSessionClients) {
         if (targets && !targets.has(clientToken)) continue;
         try { client.onFrame(frame); } catch {}
       }
     },
     async close(reason = 'daemon shutdown') {
-      for (const [clientToken, client] of localEngineClients) {
+      for (const [clientToken, client] of localSessionClients) {
         try { client.onFatal(reason); } catch {}
-        try { engineService.releaseClient(clientToken); } catch {}
+        try { sessionService.releaseClient(clientToken); } catch {}
       }
-      localEngineClients.clear();
+      localSessionClients.clear();
     },
   };
-  uninstallLocalEngineBridge = installEngineDaemonLocalBridge(localEngineBridge);
-  const engineDaemonClientModule = () => import('./engine-daemon-client.mjs');
   const desktopRuntime = {
-    async createRemoteEngineSession(options) {
-      return (await engineDaemonClientModule()).createRemoteEngineSession(options);
-    },
-    async callDaemonSession(options) {
-      return (await engineDaemonClientModule()).callDaemonSession(options);
+    async attachSessionClient(options = {}) {
+      if (!localSessionBridge) throw new Error('daemon-local session client is unavailable');
+      return localSessionBridge.attach(options);
     },
     loadProjects: () => import('./projects.mjs'),
     loadSessionStore: () => import('../runtime/agent/orchestrator/session/store-summary-reader.mjs'),
-    loadStatuslineSegments: () => import('../ui/statusline-segments.mjs'),
     loadConfig: () => import('../runtime/shared/config.mjs'),
     loadCommitCompletion: () => import(
       '../runtime/agent/orchestrator/agent-runtime/commit-message-completion.mjs'
@@ -437,68 +521,96 @@ async function main() {
       return graph.executeCodeGraphTool(name, args, cwd);
     },
   };
-  let engineModulePromise = null;
-  let engineRuntimePrewarmStarted = false;
-  function loadEngineModule() {
-    if (!engineModulePromise) {
-      engineModulePromise = import('../tui/engine-local-session.mjs').catch((error) => {
-        engineModulePromise = null;
-        throw error;
-      });
-    }
-    return engineModulePromise;
-  }
-  function prewarmEngineRuntime() {
-    if (engineRuntimePrewarmStarted) return;
-    engineRuntimePrewarmStarted = true;
-    void loadEngineModule()
-      .then((engineModule) => {
-        engineModule.preloadSessionRuntimeModule?.();
-        engineModule.preloadKeychainSecrets?.();
-        log('engine runtime/keychain prewarm started');
-      })
+  let sessionRuntimePrewarmStarted = false;
+  sessionRuntimePool = createSessionRuntimePool({ cwd: CWD, log });
+  function prewarmSessionRuntime() {
+    if (sessionRuntimePrewarmStarted) return;
+    sessionRuntimePrewarmStarted = true;
+    void sessionRuntimePool.prewarm()
+      .then(() => log('session shard runtime/agent-loop/keychain prewarm started'))
       .catch((error) => {
-        engineRuntimePrewarmStarted = false;
-        log(`engine runtime/keychain prewarm failed (non-fatal): ${error?.message || error}`);
+        sessionRuntimePrewarmStarted = false;
+        log(`session runtime/keychain prewarm failed (non-fatal): ${error?.message || error}`);
       });
   }
-  engineService = createEngineDaemonService({
-    createEngine: async (options) => {
-      const engineModule = await loadEngineModule();
-      return engineModule.createLocalEngineSession(options);
+  sessionService = createSessionService({
+    createSessionRuntime: (options) => sessionRuntimePool.create(options),
+    sessionExists: async (sessionId) => {
+      const store = await desktopRuntime.loadSessionStore();
+      return store.storedSessionExists?.(sessionId) === true;
+    },
+    listSessions: async (options = {}) => {
+      const store = await desktopRuntime.loadSessionStore();
+      return store.listStoredSessionSummaries({
+        refreshFromStorage: options.refreshFromStorage === true,
+      });
     },
     desktopRuntime,
     onFrame: (frame, targetTokens) => {
-      localEngineBridge?.publish(frame, targetTokens);
-      engineTransport?.broadcast(frame, targetTokens);
+      localSessionBridge?.publish(frame, targetTokens);
+      sessionTransport?.broadcast(frame, targetTokens);
     },
     onExternalClientsChanged: () => { maybeSelfShutdown('remote clients changed'); },
     log,
   });
-  engineTransport = createEngineDaemonTransport({
-    // ctx carries the CLIENT token: the engine pool refcounts views across
-    // processes with it, so a terminal exiting cannot destroy the engine a
+  sessionTransport = createSessionTransport({
+    // ctx carries the CLIENT token: the session pool refcounts views across
+    // processes with it, so a terminal exiting cannot destroy the session a
     // desktop window is still streaming.
-    handleCall: (name, args, ctx) => engineService.handleCall(name, args, ctx),
-    discoveryPath: ENGINE_DISCOVERY_PATH,
+    handleCall: (name, args, ctx) => sessionService.handleCall(name, args, ctx),
     log,
     // `busy` is what stops a newer install from draining a daemon that is
     // mid-turn: work outlives views AND installs.
     getStatus: () => ({
-      engines: engineService.size,
-      busy: engineService.busyCount,
+      sessions: sessionService.size,
+      busy: sessionService.busyCount,
+      sessionPool: sessionService.status,
+      sessionShards: sessionRuntimePool.status,
+      workload: {
+        resources: resourceAdmission.snapshot(),
+        childSpawns: childSpawnSnapshot(),
+        toolIo: toolWorkloadSnapshot(),
+        mcp: getMcpAdmissionSnapshot(),
+        providers: providerAdmissionScheduler.snapshot(),
+        streamParsing: providerStreamJsonSnapshot(),
+      },
+      memory: {
+        ...(() => {
+          const usage = process.memoryUsage();
+          return {
+            rssBytes: usage.rss,
+            heapTotalBytes: usage.heapTotal,
+            heapUsedBytes: usage.heapUsed,
+            externalBytes: usage.external,
+            arrayBufferBytes: usage.arrayBuffers,
+          };
+        })(),
+      },
       ...eventLoopStatus(),
     }),
-    onClientsEmpty: () => { maybeSelfShutdown('no live engine views'); },
-    onClientRegistered: () => { prewarmEngineRuntime(); },
-    onClientDropped: (token) => { try { engineService.releaseClient(token); } catch {} },
+    onClientsEmpty: () => { maybeSelfShutdown('no live session clients'); },
+    onClientRegistered: () => { prewarmSessionRuntime(); },
+    onClientDropped: (token) => { try { sessionService.releaseClient(token); } catch {} },
+    onUpgradeRequested: requestDaemonReplacement,
   });
-  const engineEndpoint = await engineTransport.start();
-  log(`engine front door on 127.0.0.1:${engineEndpoint.port}`);
+  const sessionEndpoint = await sessionTransport.start();
+  writeJsonAtomicSync(DAEMON_DISCOVERY_PATH, {
+    protocol: SESSION_PROTOCOL,
+    revision: SESSION_REVISION,
+    version: runtimeVersion(),
+    capabilityFingerprint: SESSION_CAPABILITY_FINGERPRINT,
+    pid: process.pid,
+    startedAt: Date.now(),
+    endpoints: {
+      channel: { port, token },
+      session: { port: sessionEndpoint.port, token: sessionEndpoint.token },
+    },
+  }, { compact: true });
+  log(`session front door on 127.0.0.1:${sessionEndpoint.port}`);
 
-  // Ready handshake for the spawner FIRST (mirrors the memory daemon's ready
-  // port). Transport is already listening; signal ready before the heavy
-  // Discord connect so the spawner's ready wait never blocks on backend I/O.
+  // Ready handshake for the spawner first. Transport is already listening;
+  // signal ready before the heavy
+  // Discord connect so the spawner's ready wait never blocks on service I/O.
   // Take over file logging from the spawner at the ready boundary. No rotate
   // here: the spawner already bounds the file at its own boot (channel-worker
   // rotateBoundedLog), and rotating now would race other processes' buffered
@@ -533,18 +645,16 @@ async function main() {
 
   // Boot messaging only for an explicit manual remote request. Automation may
   // spawn the shared daemon with no remote intent; keep schedules/webhooks live
-  // without connecting the channel backend until a manual Remote ON arrives.
-  // Legacy `auto` intent is deliberately ignored.
+  // without connecting the channel service until a manual Remote ON arrives.
   // A TUI-spawned daemon keeps the historical eager start (its channels client
-  // is already on the way). An engine-spawned one waits for a real channels
+  // is already on the way). A session-spawned one waits for a real channels
   // client — see the transport's onClientRegistered hook.
-  if (process.env.MIXDOG_DAEMON_SPAWNED_FOR !== 'engine') startChannels();
+  if (process.env.MIXDOG_DAEMON_SPAWNED_FOR !== 'session') startChannels();
 
-  // Fold memory startup in: eagerly ensure the memory runtime is up under the
-  // daemon's lifecycle (spawn-or-attach singleton). Fire-and-forget — memory
-  // boot is heavy (DB/embeddings) and must NOT delay the ready handshake below
-  // (the spawner's ready wait would time out); the proxy publishes memory_port
-  // to active-instance.json when ready and memory-client buffers until then.
+  // Memory owns a separate process/event loop. Initialization stays
+  // asynchronous because DB/embedding startup must not delay the front-door
+  // ready handshake. The proxy retains it for this daemon pid and its
+  // client-grace lifecycle reaps it only after the daemon is gone.
   // Isolated test roots opt out (MIXDOG_DAEMON_SKIP_MEMORY=1): spinning a
   // throwaway Postgres cluster per test run is pure cost, and a hard-killed
   // daemon would orphan it.
@@ -553,8 +663,14 @@ async function main() {
     return;
   }
   try {
-    memoryRuntime = createStandaloneMemoryRuntime({ entry: MEMORY_ENTRY, dataDir: DATA_DIR, cwd: CWD });
-    void memoryRuntime.start().catch((e) => log(`memory.start failed (non-fatal): ${e?.message || e}`));
+    memoryRuntime = getStandaloneMemoryRuntime({
+      entry: MEMORY_ENTRY,
+      dataDir: DATA_DIR,
+      cwd: CWD,
+    });
+    void memoryRuntime.init()
+      .then(() => log('memory runtime ready in isolated process'))
+      .catch((e) => log(`memory.start failed (non-fatal): ${e?.message || e}`));
   } catch (e) { log(`memory.start setup failed (non-fatal): ${e?.message || e}`); }
 }