mixdog 0.9.95 → 0.9.97

package/src/runtime/agent/orchestrator/session/loop/tool-exec.mjs

@@ -23,6 +23,7 @@ import {
 } from './tool-helpers.mjs';
 import { isOnDeferredToolSurface, prepareDeferredToolCallThrough } from './deferred-call-through.mjs';
 import { preDispatchDenyForSession, routeWebFetchCall } from './pre-dispatch-deny.mjs';
+import { runWithToolExecutionOwner } from '../../../../shared/tool-execution-owner.mjs';
 
 let codeGraphRuntimePromise = null;
 async function executeCodeGraphToolLazy(name, args, cwd, signal = null, options = {}) {
@@ -32,6 +33,11 @@ async function executeCodeGraphToolLazy(name, args, cwd, signal = null, options
     return mod.executeCodeGraphTool(name, args, cwd, signal, options);
 }
 
+export function resolveLiveToolCwd(cwd, sessionRef) {
+    const liveCwd = typeof sessionRef?.cwd === 'string' ? sessionRef.cwd : '';
+    return liveCwd || cwd;
+}
+
 export function _scopedCacheOutcomeForCall(sessionRef, toolCallId, toolName, callerSessionId, executeOpts = {}) {
     if (executeOpts.scopedCacheOutcome) {
         if (sessionRef && toolCallId) {
@@ -51,7 +57,16 @@ export function _scopedCacheOutcomeForCall(sessionRef, toolCallId, toolName, cal
     return outcome;
 }
 
-export async function executeTool(name, args, cwd, callerSessionId, sessionRef, executeOpts = {}) {
+export function executeTool(name, args, cwd, callerSessionId, sessionRef, executeOpts = {}) {
+    return runWithToolExecutionOwner(callerSessionId, () =>
+        executeToolOwned(name, args, cwd, callerSessionId, sessionRef, executeOpts));
+}
+
+async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, executeOpts = {}) {
+    // cwd is captured when the turn starts. The deferred cwd tool updates
+    // sessionRef.cwd in place, so every later tool call must re-read that live
+    // value instead of continuing to use the stale turn snapshot.
+    cwd = resolveLiveToolCwd(cwd, sessionRef);
     const scopedCacheOutcome = _scopedCacheOutcomeForCall(
         sessionRef,
         executeOpts.toolCallId,
@@ -174,7 +189,10 @@ export async function executeTool(name, args, cwd, callerSessionId, sessionRef,
             && mcpToolHasField(name, 'cwd')
             && (args == null || args.cwd == null);
         const finalArgs = needsCwdInjection ? { ...(args || {}), cwd } : args;
-        return executeMcpTool(name, finalArgs);
+        return executeMcpTool(name, finalArgs, {
+            signal: executeOpts.signal || null,
+            ownerKey: callerSessionId,
+        });
     }
     if (name === 'code_graph') {
         // cwd chain: args.cwd (caller-explicit) → session cwd → undefined (handler throws)
@@ -227,36 +245,10 @@ export async function executeTool(name, args, cwd, callerSessionId, sessionRef,
     }
     if (name === 'apply_patch') {
         const patchArgs = typeof args === 'string' ? { patch: args } : { ...(args || {}) };
-        // post_shell: optional verification command executed through the normal
-        // one-shot shell path ONLY after the patch applies cleanly; a failed
-        // patch skips it. Patch text and shell output return as ONE tool
-        // result, so patch+verify costs a single call. Runtime-only knob:
-        // stripped before executePatchTool sees the args.
-        const postShell = typeof patchArgs.post_shell === 'string' && patchArgs.post_shell.trim()
-            ? patchArgs.post_shell.trim()
-            : null;
-        delete patchArgs.post_shell;
-        const patchResult = await executePatchTool(name, patchArgs, cwd, {
+        return executePatchTool(name, patchArgs, cwd, {
             sessionId: callerSessionId,
             toolCallId: executeOpts.toolCallId || null,
         });
-        if (!postShell) return patchResult;
-        const patchNorm = normalizeToolEnvelope(patchResult);
-        const patchText = typeof patchNorm.result === 'string' ? patchNorm.result : String(patchNorm.result ?? '');
-        // Text-based failure detection only: legacy string returns normalize
-        // to explicitSuccess:false even on success, so that flag is unusable here.
-        const patchFailed = /^Error[\s:[]/.test(patchText.trimStart());
-        if (patchFailed) {
-            return `${patchText}\n--- post_shell skipped: patch failed ---`;
-        }
-        const shellRes = await executeBuiltinTool('shell', { command: postShell }, cwd, completionToolOpts);
-        const shellNorm = normalizeToolEnvelope(shellRes);
-        const shellText = typeof shellNorm.result === 'string' ? shellNorm.result : String(shellNorm.result ?? '');
-        const shellFailed = /^Error[\s:[]/.test(shellText.trimStart());
-        const header = shellFailed
-            ? '--- post_shell FAILED (patch is applied; fix and re-verify) ---'
-            : '--- post_shell ---';
-        return `${patchText}\n\n${header}\n${shellText}`;
     }
     if (isBuiltinTool(name)) {
         // clientHostPid threaded for the same per-terminal job-scope reason as

package/src/runtime/agent/orchestrator/session/loop/tool-helpers.mjs

@@ -12,7 +12,6 @@ import {
     isSkillDisabled,
 } from '../../context/collect.mjs';
 import { isAgentOwner } from '../../agent-owner.mjs';
-import { _isMutationTool } from './tool-classify.mjs';
 
 // Eager-dispatch: tools with readOnlyHint:true in their declaration are safe
 // to execute during SSE parsing so tool work overlaps with the rest of the
@@ -41,16 +40,14 @@ export function isEagerDispatchable(name, tools) {
     return set.has(name);
 }
 
-// Full-parallel dispatch policy: EVERY tool call in an assistant turn starts
-// executing immediately — ordering across dependent work is the MODEL's job
-// (split into separate turns). The only exception is the ordered mutation
-// (apply_patch), which stays in the serial batch body so multi-patch turns
-// keep deterministic order, the all-or-nothing failure gate, and cache
-// invalidation sequencing. isEagerDispatchable above remains the READ-ONLY
-// classifier used for dedup eligibility, steering, and post-mutation result
-// invalidation.
+// Full dispatch policy: EVERY valid tool call in an assistant turn is queued
+// immediately. Mutations rely on their own conflict scope (apply_patch uses
+// per-path locks); the eager dispatcher adds only the apply_patch -> shell
+// execution barrier required for same-turn validation.
+// isEagerDispatchable above remains the READ-ONLY classifier used for dedup
+// eligibility, steering, and post-mutation result invalidation.
 export function isParallelDispatchable(name) {
-    return typeof name === 'string' && name.length > 0 && !_isMutationTool(name);
+    return typeof name === 'string' && name.length > 0;
 }
 
 // Read-only is necessary but not sufficient for result deduplication. Loader

package/src/runtime/agent/orchestrator/session/manager/ask-session.mjs

@@ -67,6 +67,17 @@ import {
 import { _getAgentLoop } from './runtime-loaders.mjs';
 import { getAgentRuntimeSync } from './agent-runtime-singleton.mjs';
 import { recordProviderContextBaseline } from '../loop/compact-policy.mjs';
+import { runAbortable, settleWithin, throwIfAborted } from '../../../../shared/abort-race.mjs';
+
+export const DEFAULT_ASK_CLEANUP_SETTLE_MS = 2_000;
+
+export async function settleAskCleanup(promise, { timeoutMs } = {}) {
+    const configured = Number(process.env.MIXDOG_ASK_CLEANUP_SETTLE_MS);
+    const budget = Number.isFinite(Number(timeoutMs)) && Number(timeoutMs) > 0
+        ? Number(timeoutMs)
+        : (Number.isFinite(configured) && configured > 0 ? configured : DEFAULT_ASK_CLEANUP_SETTLE_MS);
+    return await settleWithin(promise, budget);
+}
 
 export function persistedAssistantTranscriptMetadata(value, fallbackAt = Date.now()) {
     if (!value || typeof value !== 'object') return null;
@@ -196,7 +207,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
     if (process.env.MIXDOG_DEBUG_AGENT) {
         process.stderr.write(`[agent-trace] t0-ask-start sessionHash=${createHash('sha256').update(String(sessionId)).digest('hex').slice(0, 8)} role=? iteration=0 promptSrc=${_promptSrc} prefetchFiles=${_prefetchFiles} callers=${_prefetchCallers} references=${_prefetchRefs}\n`);
     }
-    const unlock = await acquireSessionLock(sessionId);
+    const unlock = await acquireSessionLock(sessionId, askOpts?.signal);
     // Start crash-spool hydration without delaying the user turn. A completed
     // background hydration joins the id-deduped memory drain below.
     const takeoverHydration = hydratePendingMessages(sessionId);
@@ -309,9 +320,10 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
         // computation would run detached. Capture the linked signal, install the
         // fresh controller, then re-cascade it — aborting the new controller
         // immediately when the parent already fired, or re-arming the listener.
-        const _linkedParentSignal = runtime.parentAbortLink?.signal;
+        const _linkedParentSignal = askOpts?.signal || runtime.parentAbortLink?.signal;
         // Fresh controller per ask — the previous ask's controller may have aborted.
         runtime.controller = createAbortController();
+        const turnSignal = runtime.controller.signal;
         runtime.generation = askGeneration;
         runtime.closed = false;
         runtime.session = preSession;
@@ -469,7 +481,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
             // even to the real task. Single-turn structure with a labelled
             // `# Task` block forces the model to treat the brief as the work
             // unit, not as another piece of context to ack.
-            const explicitPrefetchResult = await _tryBridgeExplicitPrefetch(session, explicitPrefetch);
+            const explicitPrefetchResult = await _tryBridgeExplicitPrefetch(session, explicitPrefetch, turnSignal);
             let _contextBlock = '';
             if (context) {
                 _contextBlock += `# Additional context\n${_capCtx(context)}\n\n`;
@@ -574,7 +586,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                     },
                 });
             } catch { /* trace must never break the ask path */ }
-            const agentLoop = await _getAgentLoop();
+            const agentLoop = await runAbortable(turnSignal, () => _getAgentLoop());
             const _trackTextDelta = (chunk) => {
                 _turnInterruption.recordTextDelta(chunk);
                 _scheduleTurnCheckpoint();
@@ -645,10 +657,15 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                     onProviderSendStarted: () => {
                         _turnInterruption.markProviderSendStarted();
                         _scheduleTurnCheckpoint(true);
+                        try { askOpts?.onProviderSendStarted?.(); } catch {}
                     },
                     onToolPhaseStarted: () => {
                         _turnInterruption.markToolPhaseStarted();
                         _scheduleTurnCheckpoint(true);
+                        try { askOpts?.onToolPhaseStarted?.(); } catch {}
+                    },
+                    onToolPhaseCompleted: (detail) => {
+                        try { askOpts?.onToolPhaseCompleted?.(detail); } catch {}
                     },
                     onUsageDelta: (d) => {
                         persistIterationMetrics(d).catch(() => {});
@@ -761,6 +778,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                     session.toolApprovalHook = priorToolApprovalHook;
                 }
             }
+            throwIfAborted(turnSignal);
             // Post-loop validation: if closeSession() landed while we were awaiting,
             // drop the save so the tombstone on disk isn't overwritten.
             const currentRuntime = _getRuntimeEntry(sessionId);
@@ -895,7 +913,10 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                 // Unified total-prompt field. Anthropic = input+cache_read+cache_write
                 // (additive); OpenAI OAuth/API/Gemini = input_tokens already includes the
                 // cached portion (inclusive), so the fallback must not double-count.
-                const { isInclusiveProvider, computeCostUsd } = await import('../../../../shared/llm/cost.mjs');
+                const { isInclusiveProvider, computeCostUsd } = await runAbortable(
+                    turnSignal,
+                    () => import('../../../../shared/llm/cost.mjs'),
+                );
                 const inclusive = isInclusiveProvider(session.provider);
                 const promptTokens = typeof result.usage.promptTokens === 'number'
                     ? result.usage.promptTokens
@@ -1037,15 +1058,14 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                         }
                         try {
                             const durableSave = saveSessionAsync(activeSession, { expectedGeneration: askGeneration });
-                            if (finalized.responsePreserved) {
-                                await finalizePendingMessageDelivery(
+                            const cleanup = finalized.responsePreserved
+                                ? finalizePendingMessageDelivery(
                                     activeSession, _turnPendingEntries, durableSave,
                                     () => saveSessionAsync(activeSession, { expectedGeneration: askGeneration }),
-                                );
-                            } else {
-                                await durableSave;
-                            }
-                            clearTurnCheckpoint(sessionId, _turnCheckpointToken);
+                                )
+                                : durableSave;
+                            const cleanupResult = await settleAskCleanup(cleanup);
+                            if (cleanupResult.settled) clearTurnCheckpoint(sessionId, _turnCheckpointToken);
                         } catch { /* cancellation cleanup is best-effort */ }
                         if (currentRuntime) currentRuntime.session = activeSession;
                     } else releasePendingMessages(sessionId, _turnPendingEntries);
@@ -1083,35 +1103,34 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                 else releasePendingMessages(sessionId, _turnPendingEntries);
                 try {
                     const durableSave = saveSessionAsync(activeSession, { expectedGeneration: askGeneration });
-                    if (finalized.responsePreserved) {
-                        await finalizePendingMessageDelivery(
+                    const cleanup = finalized.responsePreserved
+                        ? finalizePendingMessageDelivery(
                             activeSession, _turnPendingEntries, durableSave,
                             () => saveSessionAsync(activeSession, { expectedGeneration: askGeneration }),
-                        );
-                    } else {
-                        await durableSave;
-                    }
-                    _errorStateDurable = true;
+                        )
+                        : durableSave;
+                    _errorStateDurable = (await settleAskCleanup(cleanup)).settled;
                 } catch { /* provider-failure history persistence is best-effort */ }
                 const currentRuntime = _getRuntimeEntry(sessionId);
                 if (currentRuntime) currentRuntime.session = activeSession;
             } else {
-                const promptPersisted = await persistCompactedOutgoingAfterAskFailure({
+                const compactPersist = await settleAskCleanup(persistCompactedOutgoingAfterAskFailure({
                     sessionId,
                     activeSession,
                     askGeneration,
                     turnOutgoing: _turnOutgoing,
                     error: err,
-                });
+                }));
+                const promptPersisted = compactPersist.settled && compactPersist.value === true;
                 if (promptPersisted) {
                     recordPendingMessageDelivery(activeSession, _turnPendingEntries);
                     try {
                         const durableSave = saveSessionAsync(activeSession, { expectedGeneration: askGeneration });
-                        await finalizePendingMessageDelivery(
+                        const cleanup = finalizePendingMessageDelivery(
                             activeSession, _turnPendingEntries, durableSave,
                             () => saveSessionAsync(activeSession, { expectedGeneration: askGeneration }),
                         );
-                        _errorStateDurable = true;
+                        _errorStateDurable = (await settleAskCleanup(cleanup)).settled;
                     } catch {}
                 } else {
                     releasePendingMessages(sessionId, _turnPendingEntries);
@@ -1119,8 +1138,9 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
             }
             if (!_errorStateDurable && activeSession) {
                 try {
-                    await saveSessionAsync(activeSession, { expectedGeneration: askGeneration });
-                    _errorStateDurable = true;
+                    _errorStateDurable = (await settleAskCleanup(
+                        saveSessionAsync(activeSession, { expectedGeneration: askGeneration }),
+                    )).settled;
                 } catch { /* retain checkpoint when canonical persistence fails */ }
             }
             if (_errorStateDurable) clearTurnCheckpoint(sessionId, _turnCheckpointToken);

package/src/runtime/agent/orchestrator/session/manager/compaction-runner.mjs

@@ -77,8 +77,7 @@ function addCompactUsageToSession(session, usage) {
     session.totalUncachedInputTokens = (session.totalUncachedInputTokens || 0) + uncachedInputTokens;
     session.tokensCumulative = (session.tokensCumulative || 0) + inputTokens + outputTokens;
 }
-// A dead/unreachable memory runtime makes each proxy RPC wait ~30s (waitForPort)
-// and retry once (memory-runtime-proxy.mjs) — that must NEVER wedge the
+// A stalled memory call must NEVER wedge the
 // compact//clear path. Bound every recall-fasttrack memory call with a short
 // local timeout: on timeout we abort (best-effort cancel via a chained signal)
 // and treat it exactly like an RPC failure, so compaction proceeds WITHOUT
@@ -93,7 +92,7 @@ function recallMemoryTimeoutMs(session) {
     // misconfigured tiny value can't turn the bound into a busy no-wait.
     return Math.max(250, configured || RECALL_MEMORY_CALL_TIMEOUT_MS);
 }
-// Cold-start allowance (clear/manual path only): a booting memory daemon can
+// Cold-start allowance (clear/manual path only): a booting memory runtime can
 // miss the tight first bound (waitForPort + first-RPC warmup ~2-10s). On a
 // timeout we retry ONCE with a longer bound before honoring the bail-to-
 // semantic contract, so a rebooting runtime succeeds instead of instantly

package/src/runtime/agent/orchestrator/session/manager/pending-messages.mjs

@@ -1,7 +1,8 @@
 // Steering / pending-message queue with sync buffered + atomic-file persistence.
 // Extracted verbatim from manager.mjs (behavior-preserving).
 import { join } from 'path';
-import { readFileSync, statSync } from 'fs';
+import { readFileSync } from 'fs';
+import { stat } from 'fs/promises';
 import { createHash, randomBytes } from 'crypto';
 import { resolvePluginData } from '../../../../shared/plugin-paths.mjs';
 import { updateJsonAtomic } from '../../../../shared/atomic-file.mjs';
@@ -20,8 +21,8 @@ const PENDING_ORPHAN_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 const PENDING_ORPHAN_GRACE_MS = 60 * 60 * 1000;
 // Replay window for genuine user/steering entries. A cross-surface submit is
 // meant for a LIVE owner; entries that predate this process and exceeded the
-// window are still DELIVERED (CC parity, reference messageQueueManager.ts:
-// queued user input is never silently discarded), but annotated with an
+// window are still DELIVERED (queued user input is never silently
+// discarded), but annotated with an
 // explicit late-delivery header so a session resumed hours later reads them
 // as clearly-late input instead of a surprise self-injection.
 const STALE_USER_INJECTION_TTL_MS = 30 * 60 * 1000;
@@ -44,7 +45,7 @@ function isStaleUserInjection(entry, now = Date.now()) {
     return (now - enqueuedAt) > STALE_USER_INJECTION_TTL_MS;
 }
 
-// CC parity: never silently discard queued user input. A stale entry is
+// Never silently discard queued user input. A stale entry is
 // delivered with this explicit age-annotated header so neither the user nor
 // the model mistakes it for fresh input.
 function lateDeliveryText(text, entry, now = Date.now()) {
@@ -823,7 +824,7 @@ export function hydratePendingMessages(sessionId, options = {}) {
                 if (!id || inDelivery.has(id) || acked.has(id)) return false;
                 return true;
             });
-            // CC parity: stale genuine user/steering entries DELIVER with a
+            // Stale genuine user/steering entries DELIVER with a
             // late-delivery header instead of being silently dropped (the old
             // behavior discarded them; user report: remote/steering sends
             // silently ignored around owner restarts). Completion entries
@@ -1092,8 +1093,14 @@ export function enqueueRemotePendingMessage(sessionId, message) {
 // several sessions (desktop tabs, TUI + engine hosts) and a single shared
 // counter let the first drain of a tick swallow the mtime bump for every
 // other session, stranding their foreign submits until the next spool write.
-const FOREIGN_SPOOL_SCAN_LIMIT = 64;
+const FOREIGN_SPOOL_SCAN_LIMIT = Math.max(
+    128,
+    Number(process.env.MIXDOG_FOREIGN_SPOOL_SCAN_LIMIT) || 512,
+);
 const _foreignSpoolScanMtimes = new Map();
+const _foreignDrainRequests = new Map();
+let _foreignDrainScheduled = false;
+let _foreignDrainRunning = false;
 
 function _rememberForeignSpoolScan(sessionId, mtime) {
     _foreignSpoolScanMtimes.delete(sessionId);
@@ -1105,28 +1112,7 @@ function _rememberForeignSpoolScan(sessionId, mtime) {
     }
 }
 
-/**
- * Owner-side drain of FOREIGN user injections for a session this process
- * owns: atomically removes (and returns the text of) genuine user/steering
- * entries that were persisted by ANOTHER process — entries known locally
- * (own steering buffers, hydrated, in-delivery, acked) and completion/
- * internal-notification entries are left untouched for the normal
- * askSession hydrate path.
- */
-export async function drainForeignUserInjections(sessionId) {
-    if (!isValidPendingSessionId(sessionId)) return [];
-    // DELIVERY path, not cleanup: this takes rows out of the spool and hands
-    // them to a live turn. A tombstoned (or otherwise invalidated) session may
-    // neither receive nor lose input, so the tombstone-TOLERANT epoch check
-    // used by the explicit cleanup mutations (ack / clear) is wrong here — the
-    // token is refused outright when it was captured from a closed session.
-    // Checked BEFORE the mtime memo so a later reopen still sees this spool
-    // state as unscanned.
-    const epochToken = currentPendingLifecycleToken(sessionId);
-    if (pendingLifecycleInvalidated(sessionId)) return [];
-    let mtime = 0;
-    try { mtime = statSync(pendingMessagesPath()).mtimeMs || 0; } catch { return []; }
-    if (_foreignSpoolScanMtimes.get(sessionId) === mtime) return [];
+function _foreignLocalIds(sessionId) {
     const localIds = new Set();
     for (const map of [_sessionPendingMessages, _pendingPersistBuffers, _hydratedPendingMessages]) {
         for (const entry of map.get(sessionId) || []) {
@@ -1146,59 +1132,86 @@ export async function drainForeignUserInjections(sessionId) {
             if (typeof id === 'string' && id) localIds.add(id);
         }
     } catch { /* ledger unavailable — in-memory sets still guard */ }
-    const taken = [];
-    // The mtime memo may ONLY be armed by a scan that actually reached a
-    // lifecycle-valid decision under the spool lock. Arming it upfront meant a
-    // drain refused in-lock (a close/detach/reopen landing in the window) still
-    // recorded this spool state as "seen": after the reopen the new owner
-    // polled the same unchanged mtime and skipped it, stranding the rows until
-    // some unrelated spool WRITE bumped the file. A refusal must leave the
-    // spool immediately pollable again.
-    let lifecycleDecided = false;
+    return localIds;
+}
+
+function _settleForeignDrain(request, value) {
+    for (const resolve of request.waiters) {
+        try { resolve(value); } catch { /* a consumer cannot break the batch */ }
+    }
+}
+
+function _scheduleForeignDrainBatch() {
+    if (_foreignDrainScheduled || _foreignDrainRunning || _foreignDrainRequests.size === 0) return;
+    _foreignDrainScheduled = true;
+    setImmediate(() => {
+        _foreignDrainScheduled = false;
+        void _flushForeignDrainBatch();
+    });
+}
+
+async function _flushForeignDrainBatch() {
+    if (_foreignDrainRunning) return;
+    _foreignDrainRunning = true;
+    const batch = [..._foreignDrainRequests.values()];
+    _foreignDrainRequests.clear();
     try {
-        // ASYNC spool lock. The sync variant parked the owning process's event
-        // loop in Atomics.wait for the whole timeout: in the daemon (PTYs,
-        // engines, IPC and SSE fan-out share one loop) every poll that lost the
-        // race froze the entire app, and it could never win against an async
-        // holder in the SAME process. Waiting off the loop also lets the
-        // in-process lock queue serialize sibling sessions for free.
+        let mtime = 0;
+        try { mtime = (await stat(pendingMessagesPath())).mtimeMs || 0; }
+        catch {
+            for (const request of batch) _settleForeignDrain(request, []);
+            return;
+        }
+        const candidates = batch.filter((request) =>
+            _foreignSpoolScanMtimes.get(request.sessionId) !== mtime
+            && !pendingLifecycleInvalidated(request.sessionId, request.epochToken));
+        for (const request of batch) {
+            if (!candidates.includes(request)) _settleForeignDrain(request, []);
+        }
+        if (candidates.length === 0) return;
+        for (const request of candidates) {
+            request.localIds = _foreignLocalIds(request.sessionId);
+            request.taken = [];
+            request.lifecycleDecided = false;
+        }
         await updateJsonAtomic(pendingMessagesPath(), (raw) => {
-            // Same authority re-read INSIDE the spool lock: a close/detach
-            // landing in this window must neither deliver to the old owner nor
-            // remove the reopened owner's rows.
-            runPendingTestHook('foreignDrain:beforeCommit', { sessionId });
-            if (pendingLifecycleInvalidated(sessionId, epochToken)) return undefined;
-            // Authoritative from here on: whatever this pass decides (take,
-            // drop-stale, or "nothing foreign here") is a real answer for THIS
-            // spool state, so the memo may skip re-scanning it.
-            lifecycleDecided = true;
             const next = normalizePendingStore(raw);
-            const q = Array.isArray(next.sessions[sessionId]) ? next.sessions[sessionId] : [];
-            if (q.length === 0) return undefined;
-            const kept = [];
-            for (const entry of q) {
-                const id = pendingMessageId(entry);
-                const text = pendingMessageText(entry);
-                const foreignUser = id && !localIds.has(id)
-                    && !isCompletionNotificationEntry(entry)
-                    && !isLegacyUnmarkedCompletionNotification(text)
-                    && text && !isInternalRuntimeNotificationText(text);
-                // CC parity: stale foreign submits still deliver, carrying a
-                // late-delivery header instead of being silently removed
-                // (user report: remote sends silently discarded around owner
-                // restarts).
-                if (foreignUser && isStaleUserInjection(entry)) {
-                    taken.push({ text: lateDeliveryText(text, entry), id });
+            let changed = false;
+            for (const request of candidates) {
+                const { sessionId, epochToken, localIds, taken } = request;
+                // Same authority re-read INSIDE the spool lock: a close/detach
+                // landing in this window must neither deliver to the old owner
+                // nor remove the reopened owner's rows.
+                runPendingTestHook('foreignDrain:beforeCommit', { sessionId });
+                if (pendingLifecycleInvalidated(sessionId, epochToken)) continue;
+                request.lifecycleDecided = true;
+                const q = Array.isArray(next.sessions[sessionId]) ? next.sessions[sessionId] : [];
+                if (q.length === 0) continue;
+                const kept = [];
+                for (const entry of q) {
+                    const id = pendingMessageId(entry);
+                    const text = pendingMessageText(entry);
+                    const foreignUser = id && !localIds.has(id)
+                        && !isCompletionNotificationEntry(entry)
+                        && !isLegacyUnmarkedCompletionNotification(text)
+                        && text && !isInternalRuntimeNotificationText(text);
+                    if (foreignUser && isStaleUserInjection(entry)) {
+                        taken.push({ text: lateDeliveryText(text, entry), id });
+                    } else if (foreignUser) {
+                        taken.push({ text, id });
+                    } else {
+                        kept.push(entry);
+                    }
+                }
+                if (taken.length === 0) continue;
+                changed = true;
+                if (kept.length > 0) next.sessions[sessionId] = kept;
+                else {
+                    delete next.sessions[sessionId];
+                    if (next.sessionTouchedAt) delete next.sessionTouchedAt[sessionId];
                 }
-                else if (foreignUser) taken.push({ text, id });
-                else kept.push(entry);
-            }
-            if (taken.length === 0) return undefined;
-            if (kept.length > 0) next.sessions[sessionId] = kept;
-            else {
-                delete next.sessions[sessionId];
-                if (next.sessionTouchedAt) delete next.sessionTouchedAt[sessionId];
             }
+            if (!changed) return undefined;
             next.updatedAt = Date.now();
             return next;
         }, {
@@ -1206,18 +1219,63 @@ export async function drainForeignUserInjections(sessionId) {
             lock: true,
             mode: PENDING_MESSAGES_MODE,
             fsync: false,
-            // Delivery polling must never wait on an async spool writer in the
-            // same daemon process: waiting synchronously prevents that writer
-            // from ever reaching its finally/release path.
+            // Delivery polling must never wait behind a spool writer. A later
+            // fs.watch/poll tick retries unchanged requests.
             timeoutMs: 0,
         });
+        for (const request of candidates) {
+            if (request.lifecycleDecided) _rememberForeignSpoolScan(request.sessionId, mtime);
+            _settleForeignDrain(request, request.taken);
+        }
     } catch (err) {
-        if (err?.code === 'ELOCKCONTENDED') return [];
-        try { process.stderr.write(`[session] foreign-injection drain failed sessionId=${sessionId}: ${err?.message || err}\n`); } catch {}
-        return [];
+        if (err?.code !== 'ELOCKCONTENDED') {
+            try { process.stderr.write(`[session] foreign-injection drain failed: ${err?.message || err}\n`); } catch {}
+        }
+        for (const request of batch) {
+            if (request.waiters.length > 0) _settleForeignDrain(request, []);
+        }
+    } finally {
+        _foreignDrainRunning = false;
+        _scheduleForeignDrainBatch();
     }
-    if (lifecycleDecided) _rememberForeignSpoolScan(sessionId, mtime);
-    return taken;
+}
+
+/**
+ * Owner-side drain of FOREIGN user injections for a session this process
+ * owns: atomically removes (and returns the text of) genuine user/steering
+ * entries that were persisted by ANOTHER process — entries known locally
+ * (own steering buffers, hydrated, in-delivery, acked) and completion/
+ * internal-notification entries are left untouched for the normal
+ * askSession hydrate path.
+ */
+export async function drainForeignUserInjections(sessionId) {
+    if (!isValidPendingSessionId(sessionId)) return [];
+    // DELIVERY path, not cleanup: this takes rows out of the spool and hands
+    // them to a live turn. A tombstoned (or otherwise invalidated) session may
+    // neither receive nor lose input, so the tombstone-TOLERANT epoch check
+    // used by the explicit cleanup mutations (ack / clear) is wrong here — the
+    // token is refused outright when it was captured from a closed session.
+    // Checked BEFORE the mtime memo so a later reopen still sees this spool
+    // state as unscanned.
+    const epochToken = currentPendingLifecycleToken(sessionId);
+    if (pendingLifecycleInvalidated(sessionId)) return [];
+    return new Promise((resolve) => {
+        const existing = _foreignDrainRequests.get(sessionId);
+        if (existing && existing.epochToken === epochToken) {
+            existing.waiters.push(resolve);
+        } else {
+            if (existing) _settleForeignDrain(existing, []);
+            _foreignDrainRequests.set(sessionId, {
+                sessionId,
+                epochToken,
+                waiters: [resolve],
+                localIds: null,
+                taken: [],
+                lifecycleDecided: false,
+            });
+        }
+        _scheduleForeignDrainBatch();
+    });
 }
 
 export function drainPendingMessages(sessionId) {