mixdog 1.0.11 → 1.1.0

package/src/session-runtime/lifecycle/session-switch/context-switch.mjs

@@ -21,6 +21,8 @@ export function createContextSwitch(deps, { ingestSessionIntoMemory, closeSurfac
   } = deps;
 
   async function switchContext({ cwd, desktopSession: nextDesktopSession, forResume = false } = {}) {
+    // Leaving the open conversation would re-key an addressed runtime.
+    deps.assertNotAddressed?.('switchContext');
     clearRoutePreparation?.();
     const session = getSession();
     if (session?.id) {
@@ -55,6 +57,7 @@ export function createContextSwitch(deps, { ingestSessionIntoMemory, closeSurfac
   }
 
   async function newSession() {
+    deps.assertNotAddressed?.('newSession');
     const session = getSession();
     if (session?.id) {
       void ingestSessionIntoMemory(session);

package/src/session-runtime/lifecycle/session-switch/resume.mjs

@@ -5,7 +5,10 @@
  */
 import { writeStatuslineRoute } from '../../statusline-route.mjs';
 import { clean, hasOwn } from '../../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
-import { toolSpecForMode, deferredSurfaceModeForLead } from '../../../runtime/agent/orchestrator/runtime-core/effort.mjs';
+import {
+  toolSpecForMode,
+  deferredSurfaceModeForLead,
+} from '../../../runtime/agent/orchestrator/runtime-core/effort.mjs';
 import { isScratchConversation } from '../shared.mjs';
 
 export function resolveResumeCwd(session, currentCwd) {
@@ -97,6 +100,9 @@ export function createSessionResume(deps, { ingestSessionIntoMemory, closeSurfac
   }
 
   async function resume(id) {
+    // An addressed runtime may only reopen its own conversation; checked
+    // before anything is retired or closed.
+    deps.assertResumeTarget?.(id);
     clearRoutePreparation?.();
     const prev = getSession();
     // Captured before the manager reopens anything: the scratch decision for

package/src/session-runtime/lifecycle/session-switch/session-delete.mjs

@@ -4,6 +4,7 @@
  * owns (shared with the context switch).
  */
 import { clean } from '../../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
+import { forgetSessionSearch } from '../../../runtime/session-search/session-search-ingest.mjs';
 import { listLeadSessions } from '../session-catalog.mjs';
 import { SESSION_ID_PATTERN } from '../shared.mjs';
 
@@ -58,6 +59,7 @@ export function createSessionDelete(deps, { cancelBackgroundTasks }) {
     if (current?.id !== sessionId) {
       const deleted = mgr.deleteSession(sessionId) === true;
       if (!deleted) return false;
+      void forgetSessionSearch(sessionId);
       // The parent is already irreversibly gone, so child cleanup is
       // best-effort and idempotent. Any vetoed child becomes sweep-eligible
       // because its retained-parent proof disappeared with the parent.
@@ -74,6 +76,7 @@ export function createSessionDelete(deps, { cancelBackgroundTasks }) {
     // immediately would let a late provider/save continuation resurrect the
     // deleted conversation after the user has moved to its replacement.
     if (mgr.closeSession(sessionId, cleanupReason, { tombstone: true }) !== true) return false;
+    void forgetSessionSearch(sessionId);
     // Active parent deletion uses the same durable tombstone boundary for
     // every linked child. Their files then mature with the parent instead of
     // disappearing while the parent task is still retained.
@@ -85,6 +88,12 @@ export function createSessionDelete(deps, { cancelBackgroundTasks }) {
     setSession(null);
     invalidateContextStatusCache();
     invalidatePreSessionToolSurface();
+    // An addressed runtime never mints a replacement under the deleted
+    // address: it becomes terminal and a new conversation needs a new entry.
+    if (deps.getAddressedSessionId?.()) {
+      deps.markAddressTerminal?.();
+      return true;
+    }
     await createCurrentSession();
     return true;
   }

package/src/session-runtime/lifecycle/teardown/session-close.mjs

@@ -63,10 +63,22 @@ export function closeOwnSession(deps, closeSurfaceSession, reason) {
 /** Plant the ordinary manager/store tombstone barrier for a canonical
  *  child session without running whole-process teardown. */
 export function closeCanonicalSession(deps, reason = 'canonical-session-close') {
-  const { getSession, setSession, mgr, invalidateContextStatusCache } = deps;
+  const { getSession, setSession, mgr, invalidateContextStatusCache, beginCanonicalClose, finishCanonicalClose } = deps;
+  // Already terminal: closing is idempotent and keeps the address.
+  if (deps.isCanonicallyClosed?.() === true) return true;
   const session = getSession?.();
   if (!session?.id || session.remoteAttached === true) return false;
-  const closed = mgr.closeSession(session.id, reason, { tombstone: true }) === true;
+  // Fence execution admission BEFORE the manager close: that close cancels the
+  // session's shells synchronously, and their completions must not be able to
+  // enqueue model work or create a conversation.
+  const fence = beginCanonicalClose?.(session.id);
+  let closed = false;
+  try {
+    closed = mgr.closeSession(session.id, reason, { tombstone: true }) === true;
+  } finally {
+    // Terminal after a durable close; admission restored when it failed.
+    finishCanonicalClose?.(fence, closed);
+  }
   if (!closed) return false;
   setSession?.(null);
   invalidateContextStatusCache?.();

package/src/session-runtime/lifecycle/teardown.mjs

@@ -165,6 +165,11 @@ export function createTeardown(deps, { ingestSessionIntoMemory, closeSurfaceSess
         agentTool.closeAll(reason, scope.scopedTeardown ? { callerSessionId: scope.closingSessionId } : {});
       } catch {}
     }
+    // Release the worker/lead index exit registrations (persists pending rows
+    // first). Idempotent, so repeated closes of one runtime dispose once.
+    try {
+      agentTool.dispose?.({ settle: scope.teardownReapsWork === true });
+    } catch {}
     const { ok, stops } = await inOwnLoopTurn(() => {
       const runtimeStops = startRuntimeStops(deps, reason, scope);
       const closed = closeOwnSession(deps, closeSurfaceSession, reason);

package/src/session-runtime/local-provider-settings.mjs

@@ -10,6 +10,7 @@ export function createLocalProviderSettings({
   prepareLocalProviderModel,
   refreshLocalProviderCatalog,
   cancelLocalProviderInstallation,
+  discardLocalProviderInstallation,
   configureLocalProviderIdleTtl,
 }) {
   let commandError = null;
@@ -52,6 +53,15 @@ export function createLocalProviderSettings({
         cancelLocalProviderInstallation(jobId);
         return this.getToolModuleSettings();
       },
+      discardLocalProviderInstallation(phase, modelId) {
+        if (!['runtime', 'model', 'verify', 'repair'].includes(phase))
+          throw new TypeError('phase must be runtime, model, verify or repair.');
+        if (phase !== 'runtime' && (typeof modelId !== 'string' || !modelId.trim()))
+          throw new TypeError('modelId is required.');
+        discardLocalProviderInstallation(phase, phase === 'runtime' ? null : modelId);
+        commandError = null;
+        return this.getToolModuleSettings();
+      },
       setLocalProviderIdleTtl(seconds) {
         const idleTtlSeconds = localIdleTtlSeconds(seconds);
         const config = getConfig();

package/src/session-runtime/media-api.mjs

@@ -4,33 +4,43 @@
  * The media graph (lane catalog, adapters, asset store) is imported on first
  * use: a session that never opens the Studio must not pay for it at boot.
  */
-let laneModule = null;
-let jobModule = null;
-let storeModule = null;
-
-async function lanes() {
-  laneModule ??= await import('../runtime/media/lanes.mjs');
-  return laneModule;
-}
-
-async function jobs() {
-  jobModule ??= await import('../runtime/media/jobs.mjs');
-  return jobModule;
-}
-
-async function store() {
-  storeModule ??= await import('../runtime/media/store.mjs');
-  return storeModule;
+// Each loader keeps its literal import() so bundlers can trace it; only a
+// resolved module is cached, so a failed import is retried on the next call.
+function lazy(load) {
+  let module = null;
+  return async () => {
+    module ??= await load();
+    return module;
+  };
 }
 
-let defaultsModule = null;
-async function defaults() {
-  defaultsModule ??= await import('../runtime/media/defaults.mjs');
-  return defaultsModule;
-}
+const lanes = lazy(() => import('../runtime/media/lanes.mjs'));
+const jobs = lazy(() => import('../runtime/media/jobs.mjs'));
+const store = lazy(() => import('../runtime/media/store.mjs'));
+const defaults = lazy(() => import('../runtime/media/defaults.mjs'));
+const voice = lazy(() => import('../runtime/channels/lib/voice-setup.mjs'));
 
 export function createMediaApi() {
   return {
+    /** Read-only voice state: `voice.enabled` plus the managed whisper/ffmpeg
+     *  runtime on disk. */
+    async getVoiceStatus() {
+      return (await voice()).getVoiceStatus();
+    },
+    /** Same toggle as the session `toggleVoice` action: enabling installs any
+     *  missing whisper/ffmpeg component first. `error` carries the last
+     *  warning or failure the toggle reported. */
+    async setVoiceEnabled(enabled) {
+      const module = await voice();
+      let error = null;
+      await module.toggleVoice({
+        enabled,
+        pushNotice: (text, level) => {
+          if (level === 'warn' || level === 'error') error = text;
+        },
+      });
+      return { status: await module.getVoiceStatus(), error };
+    },
     async listMediaLanes() {
       return (await lanes()).listMediaLanes();
     },

package/src/session-runtime/model-recency.mjs

@@ -3,6 +3,19 @@
 // injected route provider (for sort priority) and webSearchCapableFor predicate.
 import { clean } from '../runtime/agent/orchestrator/runtime-core/session-text.mjs';
 import { contextWindowRange } from '../runtime/shared/llm/default-context-window.mjs';
+import { isCustomProviderName } from '../runtime/agent/orchestrator/providers/custom-reasoning.mjs';
+
+// A custom provider's effective row fields, carried when the row states them
+// (explicit false included); first-party rows never carry them.
+function customRowFields(name, m) {
+  if (!isCustomProviderName(name)) return {};
+  return {
+    ...(typeof m.name === 'string' && m.name ? { name: m.name } : {}),
+    ...(typeof m.hidden === 'boolean' ? { hidden: m.hidden } : {}),
+    ...(typeof m.manual === 'boolean' ? { manual: m.manual } : {}),
+    ...(m.customReasoning && typeof m.customReasoning === 'object' ? { customReasoning: m.customReasoning } : {}),
+  };
+}
 
 function parsedProviderModelVersion(id) {
   const text = clean(id).toLowerCase();
@@ -148,5 +161,6 @@ export function providerModelCacheRow(name, m, webSearchCapableFor) {
     defaultFast: m.defaultFast === true,
     supportsMaxMode: m.supportsMaxMode === true,
     mode: m.mode || null,
+    ...customRowFields(name, m),
   };
 }

package/src/session-runtime/model-route/route-persist.mjs

@@ -7,6 +7,13 @@ import { saveModelSettings } from '../../runtime/agent/orchestrator/runtime-core
 import { writeStatuslineRoute } from '../statusline-route.mjs';
 import { sessionUsesRoute } from '../../runtime/agent/orchestrator/runtime-core/session-route-policy.mjs';
 
+/** Re-tuning the live model (effort, Fast, context, or re-picking it) is not a
+ *  main-model choice: new tasks keep their main model unless it is that model. */
+function tunesNonMainModel(liveRoute, route, mainRoute) {
+  const sameModel = (other) => other?.provider === route.provider && other?.model === route.model;
+  return sameModel(liveRoute) && !sameModel(mainRoute);
+}
+
 export function createRoutePersistence(deps) {
   const {
     getConfig,
@@ -18,6 +25,7 @@ export function createRoutePersistence(deps) {
     adoptConfig,
     saveConfigAndAdopt,
     persistLeadRoute,
+    resolveRoute,
     invalidateContextStatusCache,
   } = deps;
   return {
@@ -27,11 +35,14 @@ export function createRoutePersistence(deps) {
         hasSecrets: getConfigHasSecrets(),
       });
     },
-    persistAdoptedModelSettings(route) {
+    persistAdoptedModelSettings(route, { keepMainModel = false } = {}) {
       // saveModelSettings is in-memory only. persistLeadRoute debounce-writes
       // the adopted config (including modelSettings). If the lead preset cannot
       // be normalized, still debounce-persist so effort/fast are not memory-only.
-      const leadRoute = persistLeadRoute(route);
+      const leadRoute =
+        keepMainModel || tunesNonMainModel(getRoute(), route, resolveRoute(getConfig(), {}))
+          ? null
+          : persistLeadRoute(route);
       if (!leadRoute) saveConfigAndAdopt(getConfig());
       return leadRoute;
     },
@@ -42,6 +53,10 @@ export function createRoutePersistence(deps) {
       if (!sessionUsesRoute(session, route)) return;
       session.fast = route.fast === true;
       session.effort = route.effectiveEffort || null;
+      // The request path reads session.modelParameters; keep only serviceTier in step.
+      const { serviceTier: _previous, ...otherParameters } = session.modelParameters || {};
+      const serviceTier = route.modelParameters?.serviceTier;
+      session.modelParameters = serviceTier ? { ...otherParameters, serviceTier } : otherParameters;
       writeStatuslineRoute(statusRoutes, session, route);
       invalidateContextStatusCache();
     },

package/src/session-runtime/model-route/route-tuning.mjs

@@ -2,7 +2,8 @@
  * route-tuning.mjs — fast and effort changes on the current main route.
  */
 import { normalizeEffortInput } from '../../runtime/agent/orchestrator/runtime-core/effort.mjs';
-import { fastCapableFor } from '../../runtime/agent/orchestrator/runtime-core/model-capabilities.mjs';
+import { selectionFastCapable } from '../route-state.mjs';
+import { ultrafastCapableFor } from '../../runtime/agent/orchestrator/runtime-core/model-capabilities.mjs';
 import { workflowPresetId } from '../../runtime/agent/orchestrator/runtime-core/workflow.mjs';
 
 export function createRouteTuning(deps, persist) {
@@ -19,9 +20,19 @@ export function createRouteTuning(deps, persist) {
   }
 
   async function setFast(value) {
-    const enabled = value === true;
+    const ultra = value === 'ultrafast';
+    const enabled = value === true || ultra;
     const modelMeta = await lookupModelMeta(getRoute().provider, getRoute().model);
-    const fastCapable = fastCapableFor(
+    // lookupModelMeta may answer with the provider's raw (unhydrated) model, so
+    // ask the capability directly instead of the row's serviceTier option.
+    if (ultra && !ultrafastCapableFor(getRoute().provider, modelMeta)) {
+      throw new Error(`ultrafast is not available for ${getRoute().provider}/${getRoute().model}`);
+    }
+    const { serviceTier: previousTier, ...otherParameters } = getRoute().modelParameters || {};
+    let modelParameters = getRoute().modelParameters;
+    if (ultra) modelParameters = { ...otherParameters, serviceTier: 'ultrafast' };
+    else if (previousTier === 'ultrafast') modelParameters = otherParameters;
+    const fastCapable = selectionFastCapable(
       getRoute().provider,
       modelMeta,
       getRoute().effectiveEffort || getRoute().effort,
@@ -36,7 +47,7 @@ export function createRouteTuning(deps, persist) {
         model: getRoute().model,
         effort: getRoute().effort,
         fast: fastCapable ? enabled : false,
-        modelParameters: getRoute().modelParameters,
+        modelParameters,
       })
     );
     await commitRouteTuning(fastCapable, modelMeta);
@@ -52,7 +63,7 @@ export function createRouteTuning(deps, persist) {
       const normalized = normalizeEffortInput(value);
       setRouteState({ ...getRoute(), effort: normalized });
       const modelMeta = await lookupModelMeta(getRoute().provider, getRoute().model);
-      const fastCapable = fastCapableFor(getRoute().provider, modelMeta, normalized, getRoute().modelParameters);
+      const fastCapable = selectionFastCapable(getRoute().provider, modelMeta, normalized, getRoute().modelParameters);
       await commitRouteTuning(fastCapable, modelMeta);
       return getRoute();
     },

package/src/session-runtime/model-route/set-route.mjs

@@ -4,7 +4,6 @@
  * (untouched, tuned, recreated, or updated in place when empty).
  */
 import { clean, hasOwn } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
-import { fastCapableFor } from '../../runtime/agent/orchestrator/runtime-core/model-capabilities.mjs';
 import {
   ensureProviderEnabled,
   findPreset,
@@ -13,9 +12,13 @@ import {
 } from '../../runtime/agent/orchestrator/runtime-core/config-helpers.mjs';
 import { getModelMetadataSync } from '../../runtime/agent/orchestrator/providers/model-catalog.mjs';
 import { workflowPresetId } from '../../runtime/agent/orchestrator/runtime-core/workflow.mjs';
-import { resolveRouteContextState } from '../route-state.mjs';
+import { resolveRouteContextState, selectionFastCapable } from '../route-state.mjs';
 import { writeStatuslineRoute } from '../statusline-route.mjs';
-import { sessionHasRouteHistory, shouldRecreateEmptySessionForRouteChange } from '../../runtime/agent/orchestrator/runtime-core/session-route-policy.mjs';
+import {
+  sessionHasRouteHistory,
+  sessionRouteCommitted,
+  shouldRecreateEmptySessionForRouteChange,
+} from '../../runtime/agent/orchestrator/runtime-core/session-route-policy.mjs';
 import { rebuildDeferredToolSurfaceForProvider } from '../../runtime/agent/orchestrator/runtime-core/tool-catalog.mjs';
 
 /** The request, completed from the live route where the caller left gaps. */
@@ -46,7 +49,7 @@ async function resolveSelectedRoute(deps, next) {
   ) {
     throw new Error(`unknown model: ${selectedRoute.provider}/${selectedRoute.model}`);
   }
-  const fastCapable = fastCapableFor(
+  const fastCapable = selectionFastCapable(
     selectedRoute.provider,
     modelMeta,
     selectedRoute.effort,
@@ -82,7 +85,7 @@ async function recreateEmptySession(deps) {
 }
 
 /** Rewrite the addressed empty session to the route it was asked to run on. */
-function updateEmptySessionInPlace(deps, session) {
+function updateSessionInPlace(deps, session, updateOptions) {
   const { getRoute, getSession, setSession, mgr, statusRoutes } = deps;
   const route = getRoute();
   const fields = {
@@ -94,53 +97,83 @@ function updateEmptySessionInPlace(deps, session) {
     contextPercent: route.contextPercent,
     selectedContextWindow: route.selectedContextWindow || null,
   };
-  const updated = mgr.updateSessionRoute?.(session.id, fields);
+  const updated = mgr.updateSessionRoute?.(session.id, fields, updateOptions);
   if (updated) setSession(updated);
   else Object.assign(session, fields);
   rebuildDeferredToolSurfaceForProvider(getSession(), route.provider);
   writeStatuslineRoute(statusRoutes, getSession(), route);
 }
 
-export function createSetRoute(deps, persist) {
+/** Validate, persist and adopt the requested route as the runtime's route. */
+async function adoptRoute(deps, persist, next, options) {
   const {
     getConfig,
     getRoute,
     setRouteState,
-    getSession,
     resolveRoute,
     refreshRouteEffort,
     refreshStatuslineUsageSnapshot,
     scheduleStatuslineUsageRefresh,
-    invalidateContextStatusCache,
-    createCurrentSession,
   } = deps;
+  const { selectedRoute, fastCapable, modelMeta } = await resolveSelectedRoute(deps, next);
+  persist.saveRouteModelSettings(selectedRoute, fastCapable);
+  // An heir opening on its source's model is not a main-model choice.
+  const leadRoute = persist.persistAdoptedModelSettings(selectedRoute, {
+    keepMainModel: options?.keepMainModel === true,
+  });
+  setRouteState(resolveRoute(getConfig(), leadRoute ? { model: workflowPresetId('lead') } : selectedRoute));
+  await refreshRouteEffort(modelMeta);
+  refreshStatuslineUsageSnapshot(getRoute());
+  scheduleStatuslineUsageRefresh();
+}
+
+/**
+ * Quota-exhaustion escape hatch: apply `next` to the addressed, ESTABLISHED
+ * session in place. The caller (session API) has already proven the latest
+ * settled turn failed on quota and that nothing is running. Starts no turn;
+ * the next turn's auto-compaction fits history to the new window.
+ */
+export function createContinueSessionInModel(deps, persist) {
+  const { getSession, invalidateContextStatusCache } = deps;
+  return async function continueSessionInModel(sessionId, next) {
+    const session = getSession();
+    if (!sessionId || !session?.id || session.id !== sessionId) {
+      throw new Error(`session ${sessionId || ''} is not the active session`);
+    }
+    await adoptRoute(deps, persist, next, {});
+    updateSessionInPlace(deps, session, { crossProvider: true });
+    invalidateContextStatusCache();
+    return true;
+  };
+}
+
+export function createSetRoute(deps, persist) {
+  const { getRoute, getSession, invalidateContextStatusCache, createCurrentSession } = deps;
 
   return async function setRoute(next, options = {}) {
     // Selection is for a new/inherited session. An explicit durable address
     // permits initializing an EMPTY session, never rewriting an existing
     // conversation's model, context boundary or provider cache.
     const applyToCurrentSession = options?.applyToCurrentSession === true;
-    const { selectedRoute, fastCapable, modelMeta } = await resolveSelectedRoute(deps, next);
-    persist.saveRouteModelSettings(selectedRoute, fastCapable);
-    const leadRoute = persist.persistAdoptedModelSettings(selectedRoute);
-    setRouteState(resolveRoute(getConfig(), leadRoute ? { model: workflowPresetId('lead') } : selectedRoute));
-    await refreshRouteEffort(modelMeta);
-    refreshStatuslineUsageSnapshot(getRoute());
-    scheduleStatuslineUsageRefresh();
+    await adoptRoute(deps, persist, next, options);
     const session = getSession();
     // Model/provider changes are next-session-only for a session the user
     // has already talked in or compacted (provider-keyed prompt cache). But
-    // an EMPTY current session — no committed route history and no in-flight
-    // first-turn prompt — has no cache to protect, so /model before the first
-    // chat takes effect live: route + statusline update immediately.
-    const currentSessionEmpty = !!session && !sessionHasRouteHistory(session);
+    // a current session with no model reply, no compaction summary and no
+    // in-flight first turn — empty, or holding only refused prompts — has no
+    // cache to protect, so /model takes effect live: route + statusline
+    // update immediately. Only a truly empty session is recreated below.
+    const currentSessionEmpty = !!session && !sessionRouteCommitted(session);
     if (!currentSessionEmpty) {
       // Some desktop effort changes travel as a same-model route update.
       // Only effort/Fast may affect the source, starting with its next turn.
       if (applyToCurrentSession) persist.applySessionTuning();
       return getRoute();
     }
+    // An addressed runtime keeps its durable id: the empty session is updated
+    // in place, never closed and replaced by a freshly minted one.
     if (
+      !deps.getAddressedSessionId?.() &&
       shouldRecreateEmptySessionForRouteChange(session, applyToCurrentSession) &&
       session?.id &&
       typeof createCurrentSession === 'function'
@@ -154,7 +187,7 @@ export function createSetRoute(deps, persist) {
       // durable address. The caller asked to apply this route to THIS empty
       // session, so update it in place instead of closing A and silently
       // materializing B before the first prompt.
-      updateEmptySessionInPlace(deps, session);
+      updateSessionInPlace(deps, session);
       invalidateContextStatusCache();
     }
     return getRoute();

package/src/session-runtime/model-route/web-search-route.mjs

@@ -4,8 +4,8 @@
  */
 import { clean, hasOwn } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
 import { coerceEffortFor } from '../../runtime/agent/orchestrator/runtime-core/effort.mjs';
-import { fastCapableFor } from '../../runtime/agent/orchestrator/runtime-core/model-capabilities.mjs';
 import { ensureProviderEnabled } from '../../runtime/agent/orchestrator/runtime-core/config-helpers.mjs';
+import { selectionFastCapable } from '../route-state.mjs';
 import {
   isDefaultWebSearchRouteConfig,
   isWebSearchCapableProvider,
@@ -71,7 +71,7 @@ export function createWebSearchRouteApi(deps) {
     // bucket belongs to the MAIN route alone, so a web-search model pick that
     // happens to match Main must not rewrite Main's saved effort/fast.
     const effort = coerceEffortFor(selectedRoute.provider, modelMeta, selectedRoute.effort);
-    const fastCapable = fastCapableFor(selectedRoute.provider, modelMeta, effort, selectedRoute.modelParameters);
+    const fastCapable = selectionFastCapable(selectedRoute.provider, modelMeta, effort, selectedRoute.modelParameters);
     return normalizeWebSearchRouteConfig({
       ...selectedRoute,
       ...(effort ? { effort } : {}),

package/src/session-runtime/model-route-api.mjs

@@ -12,7 +12,7 @@
  */
 import { createRoutePersistence } from './model-route/route-persist.mjs';
 import { createWebSearchRouteApi } from './model-route/web-search-route.mjs';
-import { createSetRoute } from './model-route/set-route.mjs';
+import { createSetRoute, createContinueSessionInModel } from './model-route/set-route.mjs';
 import { createRouteTuning } from './model-route/route-tuning.mjs';
 
 export { shouldRecreateEmptySessionForRouteChange } from '../runtime/agent/orchestrator/runtime-core/session-route-policy.mjs';
@@ -22,6 +22,7 @@ export function createModelRouteApi(deps) {
   return {
     ...createWebSearchRouteApi(deps),
     setRoute: createSetRoute(deps, persist),
+    continueSessionInModel: createContinueSessionInModel(deps, persist),
     ...createRouteTuning(deps, persist),
   };
 }

package/src/session-runtime/notification-bus.mjs

@@ -29,7 +29,13 @@ function cleanSessionId(value) {
 // the wake would leave its durable entry parked until the next user message.
 // A completion whose owner is no longer the live session is still dropped (the
 // durable queue carries it into that session's next turn).
-export function createCompletionWakeScheduler({ getCurrentSessionId, getTurnApi }) {
+export function createCompletionWakeScheduler({ getCurrentSessionId, getTurnApi, getOwnerLifecycle }) {
+  // A closing/terminal owner never starts inference from a completion; the
+  // check runs at request time and again inside the delayed callback.
+  const ownerOpen = (sessionId) => {
+    const life = getOwnerLifecycle?.(sessionId);
+    return !life || life.state === 'open';
+  };
   // sessionId -> the oldest request suppressed while this session's wake is in
   // flight, or null when nothing was suppressed. A present key means in flight.
   const inFlight = new Map();
@@ -41,6 +47,7 @@ export function createCompletionWakeScheduler({ getCurrentSessionId, getTurnApi
       try {
         const turnApi = getTurnApi();
         if (cleanSessionId(getCurrentSessionId()) !== ownerSessionId || !turnApi) return;
+        if (!ownerOpen(ownerSessionId)) return;
         const delayMs = Math.max(0, Date.now() - queuedAt);
         if (delayMs >= WAKE_DELAY_REPORT_MS) {
           process.stderr.write(
@@ -70,7 +77,7 @@ export function createCompletionWakeScheduler({ getCurrentSessionId, getTurnApi
 
   return function wakeQueuedCompletion({ sessionId, executionId, enqueuedAt } = {}) {
     const ownerSessionId = cleanSessionId(sessionId);
-    if (!ownerSessionId) return false;
+    if (!ownerSessionId || !ownerOpen(ownerSessionId)) return false;
     if (inFlight.has(ownerSessionId)) {
       const suppressed = inFlight.get(ownerSessionId);
       // Keep the oldest suppressed request so the replay reports the real wait.
@@ -99,10 +106,22 @@ function emitToListeners(source, content, meta = {}) {
   return { handled, modelVisibleDelivered: event.modelVisibleDelivered === true };
 }
 
-export function createNotificationBus({ listeners, mgr, onCompletionQueued }) {
+export function createNotificationBus({ listeners, mgr, onCompletionQueued, getOwnerLifecycle }) {
   const boundSessionListeners = new Map();
   const queuedCompletionIds = new Map();
 
+  // Owner identity + lifecycle generation. A closing/terminal owner (or a
+  // callback captured under an earlier generation) keeps its result for
+  // UI/history only: it is flagged `owner_closed`, never queued for the model
+  // and never wakes inference.
+  function ownerOpen(sessionId, capturedGeneration) {
+    const life = getOwnerLifecycle?.(sessionId);
+    if (!life) return true;
+    if (life.state !== 'open') return false;
+    return capturedGeneration === undefined || capturedGeneration === life.generation;
+  }
+  const closedMeta = (meta) => ({ ...(meta && typeof meta === 'object' ? meta : {}), owner_closed: true });
+
   function emitRuntimeNotification(content, meta = {}) {
     return emitToListeners(listeners, content, meta);
   }
@@ -111,8 +130,10 @@ export function createNotificationBus({ listeners, mgr, onCompletionQueued }) {
     const targetSessionId = cleanSessionId(sessionId);
     if (!targetSessionId) return false;
     const targetListeners = sessionNotificationListeners.get(targetSessionId) || [];
-    const { handled } = emitToListeners(targetListeners, content, meta);
+    const open = ownerOpen(targetSessionId);
+    const { handled } = emitToListeners(targetListeners, content, open ? meta : closedMeta(meta));
     if (handled) return true;
+    if (!open) return false;
     if (typeof mgr.enqueuePendingMessage !== 'function') return false;
     try {
       return mgr.enqueuePendingMessage(targetSessionId, content) > 0;
@@ -168,13 +189,15 @@ export function createNotificationBus({ listeners, mgr, onCompletionQueued }) {
     return true;
   }
 
-  function notifySessionCompletion(sessionId, text, meta = {}) {
+  function notifySessionCompletion(sessionId, text, meta = {}, capturedGeneration = undefined) {
     const targetSessionId = cleanSessionId(sessionId);
     if (!targetSessionId) return false;
     const targetListeners = sessionNotificationListeners.get(targetSessionId) || [];
+    const open = ownerOpen(targetSessionId, capturedGeneration);
     const ownerMeta = {
       ...(meta && typeof meta === 'object' ? meta : {}),
       caller_session_id: targetSessionId,
+      ...(open ? {} : { owner_closed: true }),
     };
     delete ownerMeta.routing_session_id;
     const { handled, modelVisibleDelivered } = emitToListeners(targetListeners, text, ownerMeta);
@@ -187,6 +210,7 @@ export function createNotificationBus({ listeners, mgr, onCompletionQueued }) {
       handled,
       mvd: modelVisibleDelivered,
     });
+    if (!open) return handled;
     if (modelVisibleDelivered) {
       try {
         recordDeliveredCompletion({
@@ -219,7 +243,8 @@ export function createNotificationBus({ listeners, mgr, onCompletionQueued }) {
 
   function notifyFnForSession(callerSessionId) {
     const ownerSessionId = cleanSessionId(callerSessionId);
-    return (text, meta = {}) => notifySessionCompletion(ownerSessionId, text, meta);
+    const generation = getOwnerLifecycle?.(ownerSessionId)?.generation;
+    return (text, meta = {}) => notifySessionCompletion(ownerSessionId, text, meta, generation);
   }
 
   function bindListenerToSession(sessionId, listener) {

package/src/session-runtime/provider-auth/login.mjs

@@ -10,6 +10,7 @@ import {
   saveProviderApiKey,
   saveCustomProvider,
   removeCustomProvider,
+  updateCustomProviderModel,
   testCustomProvider,
   discoverCustomProviderModels,
 } from '../services/provider-admin.mjs';
@@ -79,6 +80,11 @@ export function createLoginApi({ cfgMod, awaitKeychainPrewarm, reloadFullConfig,
       refresh.afterCredentialChange();
       return result;
     },
+    async updateCustomProviderModel(providerId, modelId, patch) {
+      const result = await updateCustomProviderModel(cfgMod, providerId, modelId, patch);
+      refresh.afterCredentialChange();
+      return result;
+    },
     async removeCustomProvider(providerId) {
       await awaitKeychainPrewarm();
       const result = removeCustomProvider(cfgMod, providerId);