mixdog 1.2.0 → 1.2.1

package/src/runtime/agent/orchestrator/session/explicit-skills.mjs

@@ -1,6 +1,10 @@
 import { randomUUID } from 'node:crypto';
 import { selectedSkillName } from '../../../shared/skill-selection.mjs';
+import { mentionedSkillNames, skillMentionCandidates } from '../../../shared/skill-mentions.mjs';
+import { isAttachmentReference } from '../../../attachments/store.mjs';
+import { collectPromptSkillsCached } from '../context/collect.mjs';
 import { executeTool } from './loop/tool-exec.mjs';
+import { preDispatchDenyForSession } from './loop/pre-dispatch-deny.mjs';
 import { parseNativeToolSearchPayload } from './loop/tool-helpers.mjs';
 import { normalizeToolEnvelope } from './tool-envelope.mjs';
 import { throwIfAborted } from '../../../shared/abort-race.mjs';
@@ -20,19 +24,91 @@ function nativeDefinitionsPresent(native, messages) {
   );
 }
 
+// At most this many skills are prepared for one user turn; further selections
+// stay prose.
+const MAX_EXPLICIT_SKILLS = 5;
+const LOADED_SKILL_RE = /^Loaded (?:built-in )?skill: /;
+
+// The user's own typed text: plain strings and text parts, never attachment
+// references (file contents the user attached, not words they typed).
+function userPromptText(prompt) {
+  if (typeof prompt === 'string') return prompt;
+  if (!Array.isArray(prompt)) return '';
+  return prompt
+    .map((part) => {
+      if (typeof part === 'string') return part;
+      if (part?.type === 'text' && typeof part.text === 'string' && !isAttachmentReference(part)) return part.text;
+      return '';
+    })
+    .join('\n');
+}
+
+/** The skills a prompt explicitly selects: the leading `Skill: "name"` header,
+ *  then every inline `$name`, each only when it names a skill enabled and in
+ *  scope for `cwd`, in first-mention order, deduplicated and capped. */
+export function explicitSkillNames(prompt, cwd) {
+  const header = selectedSkillName(prompt);
+  const text = userPromptText(prompt);
+  if (!header && !skillMentionCandidates(text).length) return [];
+  const available = new Set(collectPromptSkillsCached(cwd).map((skill) => skill.name));
+  const isSkill = (name) => available.has(name);
+  const names = header && isSkill(header) ? [header] : [];
+  for (const name of mentionedSkillNames(text, isSkill)) {
+    if (!names.includes(name)) names.push(name);
+  }
+  return names.slice(0, MAX_EXPLICIT_SKILLS);
+}
+
+/** Stamps the skills a user turn actually loaded on its transcript metadata,
+ *  where the live row, the persisted transcript and restore all read it.
+ *  The stamped message REPLACES `message` in `messages` (returned): the
+ *  session store ships reference-identical messages as an append-only delta,
+ *  so an in-place edit of a user message an earlier save already sent would
+ *  never reach disk. */
+export function recordAppliedSkills(messages, message, names) {
+  if (!message || !Array.isArray(names) || !names.length) return message;
+  const meta = message.meta && typeof message.meta === 'object' ? message.meta : {};
+  const transcript = meta.transcript && typeof meta.transcript === 'object' ? meta.transcript : {};
+  const stamped = { ...message, meta: { ...meta, transcript: { ...transcript, appliedSkills: [...names] } } };
+  const index = Array.isArray(messages) ? messages.indexOf(message) : -1;
+  if (index >= 0) messages[index] = stamped;
+  return stamped;
+}
+
+/** Tells the host which skills a user turn loaded; a host callback failure
+ *  never fails the turn. */
+export function notifySkillsApplied(onSkillsApplied, applied, message) {
+  if (!applied.length) return;
+  try {
+    onSkillsApplied?.(applied, { messageId: message?.meta?.transcript?.messageId || null });
+  } catch {
+    /* best-effort host callback */
+  }
+}
+
 // Called before the first model request for a real user turn. This performs the
 // same policy-checked Skill operation, without asking the model to request it.
 // Native schemas still travel as a properly paired loader execution, never as
-// new eager definitions or an orphan tool_search_output.
+// new eager definitions or an orphan tool_search_output. Returns the names of
+// the skills that loaded successfully, in selection order.
+// `selection`, when given (even empty), is the turn's TRUSTED selection input
+// and the only text skills are selected from: a host whose model-visible
+// prompt carries external data (webhook payloads) passes just the
+// operator-authored part, so nothing inside the data can load a skill.
 export async function prepareExplicitSkills(
   prompt,
   messages,
   session,
-  { cwd = session?.cwd, signal, execute = executeTool } = {}
+  { cwd = session?.cwd, signal, execute = executeTool, selection } = {}
 ) {
   throwIfAborted(signal);
-  const name = selectedSkillName(prompt);
-  if (name) {
+  const applied = [];
+  // A session that cannot call Skill (schema allowlist, denied tools, read-only
+  // surface — the dispatcher's own gate) has nothing to select: preparing would
+  // only push a refused-tool reminder into history on every matching turn.
+  if (preDispatchDenyForSession(session, { name: 'Skill' })) return applied;
+  const source = selection === undefined || selection === null ? prompt : selection;
+  for (const name of explicitSkillNames(source, cwd)) {
     const id = `skill-selection-${randomUUID()}`;
     const args = { name };
     const raw = await execute('Skill', args, cwd, session?.id, session, { signal, toolCallId: id });
@@ -55,6 +131,8 @@ export async function prepareExplicitSkills(
       });
     }
     messages.push(...envelope.newMessages);
+    if (LOADED_SKILL_RE.test(String(summary))) applied.push(name);
+    throwIfAborted(signal);
   }
-  throwIfAborted(signal);
+  return applied;
 }

package/src/runtime/agent/orchestrator/session/imported-message.mjs

@@ -0,0 +1,11 @@
+/**
+ * Provenance of messages carried over from another app's conversation
+ * (conversation-import). Their text is prose someone wrote elsewhere: it may
+ * look like a runtime reminder, a task envelope or a compaction summary, but
+ * restore and the model wire treat it as plain user/assistant text. Leaf, no IO.
+ */
+export const IMPORTED_MESSAGE_SOURCE = 'import';
+
+export function isImportedMessage(message) {
+  return message?.meta?.source === IMPORTED_MESSAGE_SOURCE;
+}

package/src/runtime/agent/orchestrator/session/loop/completion-guards.mjs

@@ -2,6 +2,7 @@
 // (signature + stub) and the edit-progress classification.
 // Pure string/signature helpers; the loop body only wires state + messages.
 // No provider/manager coupling.
+import { knownMcpToolIdentity } from '../../../../shared/tool-primitives.mjs';
 
 // Deterministic, key-sorted stringify for cross-turn call signatures (recursive,
 // unlike tool-classify's top-level-only _canonicalArgs).
@@ -43,7 +44,7 @@ const NON_PROGRESS_TOOLS = new Set(['Skill', 'recall', 'agent', 'task', 'cwd', '
 // not in the meta/non-progress set. apply_patch and shell/bash always count.
 export function isEditProgressTool(name, isEager) {
   if (isEager) return false;
-  const bare = name?.startsWith('mcp__') ? name.split('__').pop() : name;
+  const bare = name?.startsWith('mcp__') ? knownMcpToolIdentity(name)?.tool || name.split('__').pop() : name;
   if (bare === 'apply_patch' || bare === 'shell' || bare === 'bash' || bare === 'bash_session') return true;
   return !NON_PROGRESS_TOOLS.has(bare);
 }

package/src/runtime/agent/orchestrator/session/loop/loop-state.mjs

@@ -146,7 +146,7 @@ export function createLoopState({ provider, messages, model, tools, cwd, sendOpt
     messages,
     opts,
     sessionId,
-    onSkillPrompt: (content) => state.pendingSkillPrompts.push(content),
+    onSkillPrompt: (content, message) => state.pendingSkillPrompts.push({ content, message }),
   });
   // Bounded recovery for provider turns that returned no client tool calls
   // (max-output ladder, refusal retry, provider continuation, empty-turn

package/src/runtime/agent/orchestrator/session/loop/no-tool-turn.mjs

@@ -34,8 +34,9 @@ export function createNoToolTurnResolver({
     refusalRetryUsed: false,
     emptyNudgeStreak: 0,
     // Structured provider continuation signals honored this turn. Diagnostic
-    // only; the hard iteration cap remains the sole bound on how long a
-    // provider may keep declaring "not done" inside one user turn.
+    // only: the loop has no iteration cap, so this count bounds nothing. A
+    // text-only continuation runaway is bounded by continuationsSinceToolBatch
+    // below; continuations interleaved with tool batches are not limited.
     providerContinuationCount: 0,
     // Continuations since the last executed tool batch — bounds the text-only
     // continuation runaway (see PROVIDER_CONTINUATION_NO_TOOL_LIMIT).

package/src/runtime/agent/orchestrator/session/loop/send-phase.mjs

@@ -5,7 +5,7 @@
  */
 import { traceCacheBreak } from '../../cache-break-trace.mjs';
 import { resolveLiveToolCwd } from './tool-exec.mjs';
-import { prepareExplicitSkills } from '../explicit-skills.mjs';
+import { notifySkillsApplied, prepareExplicitSkills, recordAppliedSkills } from '../explicit-skills.mjs';
 import { addUsage, usageDeltaEvent } from './usage.mjs';
 import { prepareProviderRequest } from './request-boundary.mjs';
 import { projectProviderRequest } from './request-projection.mjs';
@@ -44,10 +44,13 @@ export async function beginIteration(state) {
   // policy-checked selection before the next provider snapshot instead of
   // starting detached work from a drain callback.
   while (state.pendingSkillPrompts.length) {
-    await prepareExplicitSkills(state.pendingSkillPrompts.shift(), messages, sessionRef, {
+    const { content, message: queued } = state.pendingSkillPrompts.shift();
+    const applied = await prepareExplicitSkills(content, messages, sessionRef, {
       cwd: state.cwd,
       signal: opts.signal,
     });
+    const message = recordAppliedSkills(messages, queued, applied);
+    notifySkillsApplied(opts.onSkillsApplied, applied, message);
   }
   const boundary = await prepareProviderRequest({
     provider,
@@ -263,8 +266,7 @@ function traceActualCacheMiss(state, sent, response, { previousGuardState, previ
   const ttlMs = MESSAGES_CACHE_TTL_MS[sessionRef.providerCacheOpts?.cacheStrategy?.messages];
   const idleMs = sent.sendStartedAt - previousSendAt;
   const requestPrefixChanged =
-    !!previousGuardState &&
-    previousGuardState.requestPrefixHash !== sent.prefixGuardCandidate?.requestPrefixHash;
+    !!previousGuardState && previousGuardState.requestPrefixHash !== sent.prefixGuardCandidate?.requestPrefixHash;
   if (
     baseline > 0 &&
     ttlMs &&

package/src/runtime/agent/orchestrator/session/loop/steering.mjs

@@ -156,7 +156,7 @@ function injectSteeringEntry(merged, { messages, opts, stage, onSkillPrompt }) {
   const notification = merged.mode === 'task-notification';
   const execution =
     notification && merged.execution && typeof merged.execution === 'object' ? { ...merged.execution } : null;
-  messages.push({
+  const message = {
     role: 'user',
     content: merged.content,
     meta: {
@@ -165,8 +165,9 @@ function injectSteeringEntry(merged, { messages, opts, stage, onSkillPrompt }) {
       ...(submissionIds.length ? { submissionIds } : {}),
       transcript: steeringTranscriptMeta,
     },
-  });
-  if (!notification) onSkillPrompt(merged.content);
+  };
+  messages.push(message);
+  if (!notification) onSkillPrompt(merged.content, message);
   const text = merged.text || steeringContentText(merged.content);
   try {
     opts.onSteerMessage?.(text, {

package/src/runtime/agent/orchestrator/session/loop/tool-helpers.mjs

@@ -12,6 +12,8 @@ import {
   filterSkillsExcludingDisabled,
   isSkillDisabled,
   skillMissingFeature,
+  skillOutsideScope,
+  skillOutsideScopeError,
 } from '../../context/collect.mjs';
 
 // Eager-dispatch: tools with readOnlyHint:true in their declaration are safe
@@ -96,6 +98,7 @@ export function viewSkill(cwd, name, session = null) {
     return `Error: skill "${skillName}" needs the ${missingFeature} built-in feature, which is not installed or is switched off in Extensions → Plugin → Built-in`;
   }
   if (isSkillDisabled(skillName)) return `Error: skill "${skillName}" is disabled`;
+  if (skillOutsideScope(skillName, cwd)) return skillOutsideScopeError(skillName);
   const res = loadSkillResource(skillName, cwd);
   if (!res) return `Error: skill "${skillName}" not found`;
   // Return the general tool envelope: the model-visible tool_result is the

package/src/runtime/agent/orchestrator/session/manager/ask-queue.mjs

@@ -12,6 +12,17 @@ import {
 
 const SYNTHETIC_PROMPT_SOURCES = ['goal-continuation', 'goal-closeout'];
 
+// A caller-declared prompt source the runtime trusts as provenance of the
+// initial prompt: Goal turns are runtime-synthetic; a task notification (an
+// idle-drained completion, an automation run's agent results) is stored like
+// one the steering/queue drains inject, never as the user speaking — so none
+// of these run explicit skill selection.
+function initialPromptSourceFor(promptSource) {
+  if (SYNTHETIC_PROMPT_SOURCES.includes(promptSource)) return { source: promptSource, synthetic: true };
+  if (promptSource === PENDING_MODE_TASK_NOTIFICATION) return { source: promptSource };
+  return null;
+}
+
 /** Prompt provenance for a drained queue turn: the source plus its execution when one exists. */
 const promptSourceFields = (source, execution) => {
   if (!source) return null;
@@ -42,9 +53,7 @@ export function createAskPromptQueue({ sessionId, promptSource }) {
   // Local FIFO of follow-up prompts drained from the pending-message queue
   // after each turn — keeps queued `agent type=send` messages in order.
   const tail = [];
-  let initialPromptSource = SYNTHETIC_PROMPT_SOURCES.includes(promptSource)
-    ? { source: promptSource, synthetic: true }
-    : null;
+  let initialPromptSource = initialPromptSourceFor(promptSource);
 
   /** The next turn's input — prompt, caller context, consumed queue entries
    *  and provenance — or null when nothing model-visible is left to run. */

package/src/runtime/agent/orchestrator/session/manager/ask-session.mjs

@@ -148,7 +148,9 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
     // queued send always lands AFTER the in-flight prompt here, ordering is
     // preserved and the spawn/connecting startup race disappears.
     for (;;) {
-      const input = queue.nextTurn({ prompt, context, explicitPrefetch });
+      // `skillSelection` (askOpts) is the trusted selection input of the
+      // caller's own prompt only; drained follow-up turns never inherit it.
+      const input = queue.nextTurn({ prompt, context, explicitPrefetch, skillSelection: askOpts.skillSelection });
       if (!input) {
         void takeoverHydration.then((count) => {
           if (count <= 0) return;

package/src/runtime/agent/orchestrator/session/manager/ask-turn-auto-effort.mjs

@@ -8,7 +8,12 @@
 // model declares effort levels (the effort is sent with each request).
 import { readSection } from '../../../../shared/config.mjs';
 import { autoEffortModel, turnEffortConfigurationMode } from '../../providers/effort-configuration.mjs';
-import { autoEffortBase, normalizeAutoEffortMode, resolveAutoEffort } from '../../providers/auto-effort.mjs';
+import {
+  autoEffortApplicable,
+  autoEffortBase,
+  normalizeAutoEffortMode,
+  resolveAutoEffort,
+} from '../../providers/auto-effort.mjs';
 import { builtinFeatureActive } from '../../runtime-core/builtin-features.mjs';
 import { effortOptionsFor } from '../../runtime-core/effort.mjs';
 import { effortJudgeSupportsSteps, judgeTurn, recordEffortDecision } from '../../../../effort-judge/judge-client.mjs';
@@ -78,12 +83,6 @@ export async function resolveTurnAutoEffort({ sessionId, session, provider, inpu
   if (!turnEffortConfigurationMode(session, provider)) return null;
   const chosen = String(session.effort || '').toLowerCase();
   const base = autoEffortBase(chosen);
-  // The previous user request shows the work a short follow-up continues.
-  const judged = await judgeTurn({
-    request,
-    prev: lastText(session.messages, 'assistant'),
-    prevRequest: lastText(session.messages, 'user'),
-  });
   const record = {
     at: new Date().toISOString(),
     sessionId,
@@ -94,15 +93,24 @@ export async function resolveTurnAutoEffort({ sessionId, session, provider, inpu
     base,
     requestChars: request.length,
   };
+  const options = effortOptionsFor(session.provider, autoEffortModel(session.provider, provider, session.model));
+  // No judged outcome can apply when the base is off the model's ladder, so
+  // the judge is not asked (in observe mode too: nothing would be logged).
+  if (!autoEffortApplicable({ base, options })) {
+    recordEffortDecision({ ...record, skipped: 'default-outside-auto-range' });
+    return null;
+  }
+  // The previous user request shows the work a short follow-up continues.
+  const judged = await judgeTurn({
+    request,
+    prev: lastText(session.messages, 'assistant'),
+    prevRequest: lastText(session.messages, 'user'),
+  });
   if (!judged.probs) {
     recordEffortDecision({ ...record, skipped: judged.skipped });
     return null;
   }
-  const resolved = resolveAutoEffort({
-    base,
-    options: effortOptionsFor(session.provider, autoEffortModel(session.provider, provider, session.model)),
-    probs: judged.probs,
-  });
+  const resolved = resolveAutoEffort({ base, options, probs: judged.probs });
   recordEffortDecision({
     ...record,
     ...(resolved || { skipped: 'default-outside-auto-range' }),

package/src/runtime/agent/orchestrator/session/manager/ask-turn-execute.mjs

@@ -5,7 +5,7 @@
 // (runAskAgentLoop). Provider-not-available and trim failures throw here so
 // the caller marks the session errored instead of leaving stage='connecting'.
 import { getProvider } from '../../providers/registry.mjs';
-import { prepareExplicitSkills } from '../explicit-skills.mjs';
+import { notifySkillsApplied, prepareExplicitSkills, recordAppliedSkills } from '../explicit-skills.mjs';
 import { prepareTurnEffortConfiguration } from '../../providers/effort-configuration.mjs';
 import { resolveTurnAutoEffort, turnStepAutoEffort } from './ask-turn-auto-effort.mjs';
 import { saveSessionAsync } from '../store.mjs';
@@ -151,9 +151,16 @@ export async function runAskAgentLoop({
   }
   try {
     if (!input.promptSource) {
-      await prepareExplicitSkills(input.prompt, outgoing, session, { cwd: effectiveCwd, signal: turnSignal });
+      const applied = await prepareExplicitSkills(input.prompt, outgoing, session, {
+        cwd: effectiveCwd,
+        signal: turnSignal,
+        selection: input.skillSelection,
+      });
+      // The user turn message sits right after the history it was built on.
+      const userMessage = recordAppliedSkills(outgoing, outgoing[prepared.beforeCount - 1], applied);
       session.messages = filterModelVisibleSessionMessages(outgoing);
       checkpoint.schedule(true);
+      notifySkillsApplied(askOpts?.onSkillsApplied, applied, userMessage);
     }
     return await _api_call_with_interrupt(sessionId, (signal) =>
       agentLoop(

package/src/runtime/agent/orchestrator/session/manager/ask-turn-loop-options.mjs

@@ -152,6 +152,10 @@ export function buildAgentLoopOptions({
       checkpoint.schedule(true);
       relay(askOpts?.onSteerMessage, text, detail);
     },
+    onSkillsApplied: (names, detail) => {
+      checkpoint.schedule(true);
+      relay(askOpts?.onSkillsApplied, names, detail);
+    },
     notifyFn: optionalFn(askOpts?.notifyFn),
     // Same projection compaction uses, so a session presents one identity on
     // every request it makes.

package/src/runtime/agent/orchestrator/session/manager/pending-message-entry.mjs

@@ -158,6 +158,14 @@ export function lateDeliveryText(text, entry, now = Date.now()) {
   return `[late delivery: queued ${age} ago, before the current session owner started]\n${value}`;
 }
 
+// A non-completion entry may be queued explicitly as a task notification (a
+// runtime/channel notice, never the user typing): the mode survives
+// normalization and the durable spool so the drain stores it as one and it
+// never drives explicit skill selection.
+function explicitModeField(entry) {
+  return entry?.mode === PENDING_MODE_TASK_NOTIFICATION ? { mode: PENDING_MODE_TASK_NOTIFICATION } : {};
+}
+
 export function normalizePendingMessageEntry(entry) {
   if (typeof entry === 'string') {
     const text = entry.trim();
@@ -173,7 +181,10 @@ export function normalizePendingMessageEntry(entry) {
     id: pendingMessageId(entry),
     enqueuedAt: Number(entry.enqueuedAt) || Date.now(),
   };
-  const entryOptions = entry.options && typeof entry.options === 'object' ? { options: entry.options } : {};
+  const entryOptions = {
+    ...(entry.options && typeof entry.options === 'object' ? { options: entry.options } : {}),
+    ...explicitModeField(entry),
+  };
   const marker =
     entry.notificationKind === COMPLETION_NOTIFICATION_KIND
       ? {
@@ -259,26 +270,28 @@ function normalizePersistedEntryBase(entry) {
         }
       : null;
   }
+  const mode = explicitModeField(entry);
   if (typeof entry.message === 'string') {
     const message = entry.message.trim();
-    return message ? { id, message, enqueuedAt } : null;
+    return message ? { id, message, ...mode, enqueuedAt } : null;
   }
   if (Object.hasOwn(entry, 'content')) {
     const normalized = normalizePendingMessageEntry(entry);
     if (!normalized) return null;
     if (typeof normalized.content === 'string' && !normalized.options) {
-      return { id, message: normalized.text || normalized.content, enqueuedAt };
+      return { id, message: normalized.text || normalized.content, ...mode, enqueuedAt };
     }
     return {
       id,
       content: normalized.content,
       text: normalized.text,
       ...(normalized.options ? { options: normalized.options } : {}),
+      ...mode,
       enqueuedAt,
     };
   }
   const text = pendingMessageText(entry);
-  return text ? { id, message: text, enqueuedAt } : null;
+  return text ? { id, message: text, ...mode, enqueuedAt } : null;
 }
 
 export function modelVisiblePendingMessages(messages) {

package/src/runtime/agent/orchestrator/session/manager.mjs

@@ -72,7 +72,6 @@ export {
 // attach-on-resume guard) — resolved through the manager facade so the
 // session-runtime turn API reaches it as mgr.publishSessionPresence.
 export { publishSessionPresence, deleteSessionPresence } from './store.mjs';
-export { isInternalRuntimeNotificationText as _isInternalRuntimeNotificationText } from './manager/prompt-utils.mjs';
 
 // ── Usage-metrics surface — re-exported unchanged so loop.mjs / smoke scripts
 //    keep resolving these through the facade. ────────────────────────────────

package/src/runtime/agent/orchestrator/session/pre-send-compact.mjs

@@ -408,9 +408,10 @@ function adoptCompactedTranscript(ctx, run) {
   // providerState so the next send starts a fresh chain.
   ctx.providerState = undefined;
   ctx.providerStateCleared = true;
-  // Compaction shrank the transcript, so prior turns no longer pressure the
-  // window — reset the iteration counter so a steadily-compacting long task
-  // isn't killed by the cap, while a non-compacting tight loop still hits it.
+  // Compaction starts a new loop epoch: the iteration counter restarts at 0
+  // so iteration indices (traces, usage metrics, cross-turn dedup windows)
+  // count from the compacted transcript. The counter bounds nothing — the
+  // loop has no iteration cap.
   ctx.iterations = 0;
   // New loop epoch so persistIterationMetrics idempotency keys do not
   // collide when iteration indices restart at 1 (incl. iter 1 → iter 1).

package/src/runtime/agent/orchestrator/session/store/listing.mjs

@@ -30,6 +30,7 @@ import { _saveAsyncQueued, _saveWorkerPending } from './save-worker.mjs';
 import { STORED_SESSION_UNREADABLE, _ensureLifecycleFields, _storedSessionFromFile } from './serialize.mjs';
 import { _savePending } from './pending-saves.mjs';
 import { isOrdinarySession } from '../store-summary-visibility.mjs';
+import { closeSessionCatalogDb } from '../catalog-db/index.mjs';
 
 // Disk mtime of the summary index when the in-memory cache was last refreshed
 // from it — the cross-process staleness detector.
@@ -145,8 +146,9 @@ function scheduleSessionSummaryIndexRebuild() {
 
 /**
  * Resolves once no summary-index writer of this process is running: the
- * background rebuild worker a cold listing (or sweep) spawned has exited and
- * every queued index mutation has landed. Both write the index, its lock and
+ * background rebuild worker a cold listing (or sweep) spawned has exited,
+ * every queued index mutation has landed and the session catalog DB is
+ * closed. Both write the index, its lock and
  * temp files into the data dir after the listing/sweep/save that caused them
  * has returned, so an owner that removes or switches the data dir awaits this
  * first.
@@ -159,6 +161,8 @@ export async function settleSessionSummaryIndex() {
     await new Promise((resolve) => worker.once('exit', resolve));
   }
   await settleSummaryIndexWrites();
+  // The daemon's session catalog DB holds its file, WAL and lock open.
+  await closeSessionCatalogDb();
 }
 
 export function listStoredSessionSummaries(options = {}) {

package/src/runtime/agent/orchestrator/session/store/summary-cache.mjs

@@ -11,6 +11,9 @@ import {
   _removeSessionSummary,
   _pruneSummaryIndexIds,
 } from '../store-summary-index.mjs';
+// In the daemon, ids whose file a write just changed are hinted to the
+// session catalog DB (a no-op in any other process).
+import { hintSessionCatalogStorage } from '../catalog-db/index.mjs';
 
 // Listing is much hotter than writing, especially while the desktop session
 // browser is open. Keep the compact sidecar in memory after the first read;
@@ -142,16 +145,19 @@ export function _queueSessionSummaryUpsertRow(row, version = null) {
     _invalidateSummaryRowsView();
   }
   _upsertSessionSummaryRow(durableRow);
+  hintSessionCatalogStorage([row.id]);
 }
 
 export function _queueSessionSummaryRemoval(id) {
   _uncacheSessionSummary(id);
   _removeSessionSummary(id);
+  hintSessionCatalogStorage([id]);
 }
 
 export function _queueSummaryIndexPrune(ids) {
   for (const id of ids) _uncacheSessionSummary(id);
   _pruneSummaryIndexIds(ids);
+  hintSessionCatalogStorage(ids);
 }
 
 // ── Incremental storage scan ────────────────────────────────────────────────