mixdog 1.2.0 → 1.2.2

package/src/tui/session/queue-helpers.mjs

@@ -175,7 +175,9 @@ export function mergePastedImages(entries) {
 
 // Byte-free image metadata for the user transcript item. Prompt content carries
 // only a content-addressed attachment ref after daemon intake; transcript items
-// and desktop snapshots carry just name/mime/size.
+// and desktop snapshots carry name/mime/size plus, for attachment-reference
+// parts, the `attachmentRef` so the desktop can rebuild thumbnails from the
+// stored original.
 export function promptContentImageMeta(content, pastedImages) {
   const parts = Array.isArray(content) ? content.filter((part) => part?.type === 'image') : [];
   if (parts.length === 0) return null;
@@ -190,6 +192,7 @@ export function promptContentImageMeta(content, pastedImages) {
       name: String(meta?.filename || `Image ${index + 1}`),
       mimeType: String(part.mimeType || part.mediaType || meta?.mediaType || 'image/png'),
       bytes: Number(part.sizeBytes) || data.length,
+      ...(isAttachmentReference(part) ? { attachmentRef: part.attachmentRef } : {}),
     };
   });
 }
@@ -202,6 +205,8 @@ export function callCommitCallbacks(entries) {
   for (const entry of entries || []) {
     try {
       entry?.onCommitted?.();
-    } catch {}
+    } catch {
+      // A throwing commit callback must not block the remaining entries.
+    }
   }
 }

package/src/tui/session/quota-resume.mjs

@@ -11,6 +11,7 @@
 import {
   cancelQuotaResumeEntry,
   forgetQuotaSuspendedGoal,
+  isAgentOnlySession,
   noteQuotaSuspendedGoal,
   publicQuotaResume,
   quotaAutoResumeEnabled,
@@ -73,6 +74,20 @@ export function latestQuotaFailure(items) {
   return null;
 }
 
+/** The turn key of the failed turndone that ends the transcript, when no
+ *  later turn has begun; '' otherwise. */
+export function latestFailedTurnKey(items) {
+  const transcript = Array.isArray(items) ? items : [];
+  for (let index = transcript.length - 1; index >= 0; index -= 1) {
+    const item = transcript[index];
+    if (item?.kind === 'user' || item?.archived === true) return '';
+    if (item?.kind !== 'turndone') continue;
+    if (String(item.status || '').toLowerCase() !== 'failed') return '';
+    return transcriptTurnKeys(transcript)[index] || '';
+  }
+  return '';
+}
+
 /** What retrying the turn submits: its prompt when it produced no output, the
  *  continuation instruction when it did, null when the prompt carried no text
  *  (a media/attachment-only prompt cannot be replayed). */
@@ -125,6 +140,8 @@ export function createQuotaResumeLane(bag) {
     routeProvider: String(runtime.sessionProvider ?? runtime.provider ?? ''),
     routeModel: String(runtime.sessionModel ?? runtime.model ?? ''),
   });
+  // A delegated agent child never owns a resume: the Lead decides its retries.
+  const agentOnly = () => isAgentOnlySession({ id: currentId(), ...runtime.session });
   const queueResume = (sessionId, failure) =>
     scheduleQuotaResumeEntry({ sessionId, turnKey: failure.turnKey, ...failure.quota, ...sessionRoute() });
 
@@ -141,6 +158,21 @@ export function createQuotaResumeLane(bag) {
     forgetQuotaSuspendedGoal(sessionId);
   };
 
+  // Anything running, settling, closing or queued owns the session first.
+  const retryBlocked = () => {
+    const state = getState();
+    return (
+      flags.disposed ||
+      settlement !== null ||
+      (flags.admission || 'open') !== 'open' ||
+      state.busy ||
+      state.commandBusy ||
+      flags.autoClearRunning ||
+      flags.draining ||
+      pending.length > 0
+    );
+  };
+
   /** The one retry operation. `automatic` is the scheduler's resume: it
    *  enqueues directly, because the hours it waited must not trigger the idle
    *  auto-clear a user submission starts. */
@@ -166,7 +198,7 @@ export function createQuotaResumeLane(bag) {
       settlement = null;
       if (!id || !failure) return null;
       settlement = { sessionId: id, turnKey: failure.turnKey, epoch: cancelEpoch };
-      if (failure.quota.resetAt === null || !quotaAutoResumeEnabled()) return null;
+      if (failure.quota.resetAt === null || !quotaAutoResumeEnabled() || agentOnly()) return null;
       return queueResume(id, failure);
     },
 
@@ -188,6 +220,7 @@ export function createQuotaResumeLane(bag) {
     /** Explicit request to auto-resume the latest quota-failed turn. */
     scheduleQuotaResume(sessionId) {
       requireAddressed(sessionId);
+      if (agentOnly()) throw new Error('agent sessions do not auto-resume; the Lead decides retries');
       const failure = latestQuotaFailure(getState().items);
       if (!failure || failure.quota.resetAt === null) {
         throw new Error('latest turn did not fail on exhausted provider quota with a known reset time');
@@ -207,9 +240,15 @@ export function createQuotaResumeLane(bag) {
       if (sessionId) cancelFor(String(sessionId));
     },
 
+    /** A deferred retry request (the desktop's switch-model flow): checked
+     *  against the session's own state when it arrives, so it runs only while
+     *  `turnKey` is still the latest failed turn and nothing is running,
+     *  settling or queued. False when refused. */
     async retryFailedTurn(sessionId, turnKey) {
       requireAddressed(sessionId);
-      return (await retryFailedTurn(String(turnKey || ''))) === true;
+      const key = String(turnKey || '');
+      if (!key || retryBlocked() || latestFailedTurnKey(getState().items) !== key) return false;
+      return (await retryFailedTurn(key)) === true;
     },
 
     /** Scheduler fire for the entry of `generation`, after a usable reading.
@@ -219,19 +258,12 @@ export function createQuotaResumeLane(bag) {
       const id = currentId();
       const entry = quotaResumeEntry(id);
       if (!id || !entry || entry.generation !== generation) return 'stale';
-      const state = getState();
-      if (
-        flags.disposed ||
-        settlement !== null ||
-        (flags.admission || 'open') !== 'open' ||
-        state.busy ||
-        state.commandBusy ||
-        flags.autoClearRunning ||
-        flags.draining ||
-        pending.length > 0
-      ) {
-        return 'busy';
+      if (agentOnly()) {
+        cancelQuotaResumeEntry(id, { generation });
+        return 'agent-session';
       }
+      const state = getState();
+      if (retryBlocked()) return 'busy';
       const failure = latestQuotaFailure(state.items);
       if (!failure || failure.turnKey !== entry.turnKey) {
         cancelQuotaResumeEntry(id, { generation });

package/src/tui/session/session-api/commands.mjs

@@ -92,34 +92,43 @@ export function createSessionCommandsApi(bag) {
     };
   };
 
+  // The compaction pass itself, under a lock its caller holds. `quiet` (the
+  // model switch's pre-compaction) asks the compactor to skip a pass that
+  // would not reduce anything and then adds no row for it.
+  async function runCompaction(startedAt, { quiet = false } = {}) {
+    // Give Ink one event-loop turn to paint the compacting spinner before
+    // runtime.compact() starts synchronous session/transcript work (same
+    // yield as the auto-clear path; without it /compact looks frozen with
+    // no spinner until the compact already finished).
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    const result = await runtime.compact({ recoverAgent: true, ...(quiet ? { requireReduction: true } : {}) });
+    const compactChanged = Boolean(result && !result.error && result.changed !== false);
+    syncContextStats({
+      allowEstimated: true,
+      invalidateExact: compactChanged,
+    });
+    set({ ...routeState(), stats: { ...getState().stats } });
+    if (compactChanged) {
+      // The compacted rows stay visible (archived) above the divider.
+      const { items } = archiveItemsForCompaction(getState().items, compactDoneItem(result, startedAt), null, {
+        archived: compactionArchivedRows(result),
+      });
+      set({ items: replaceItems(items, { preserveSpill: true }) });
+    } else if (!quiet || result?.error) {
+      pushItem(compactDoneItem(result, startedAt));
+    }
+    return result;
+  }
+
+  // An in-place model switch compacts first on the current model (routes.mjs
+  // holds the command lock and shows the compacting status meanwhile).
+  bag.compactBeforeModelSwitch = () => runCompaction(Date.now(), { quiet: true });
+
   async function compactCommand() {
     if (getState().commandBusy) return null;
     if (getState().busy) return scheduleCompactForTurnEnd(compactCommand);
     try {
-      return await withCommandStatus('Compacting conversation', 'compacting', async (startedAt) => {
-        // Give Ink one event-loop turn to paint the compacting spinner before
-        // runtime.compact() starts synchronous session/transcript work (same
-        // yield as the auto-clear path; without it /compact looks frozen with
-        // no spinner until the compact already finished).
-        await new Promise((resolve) => setTimeout(resolve, 0));
-        const result = await runtime.compact({ recoverAgent: true });
-        const compactChanged = Boolean(result && !result.error && result.changed !== false);
-        syncContextStats({
-          allowEstimated: true,
-          invalidateExact: compactChanged,
-        });
-        set({ ...routeState(), stats: { ...getState().stats } });
-        if (compactChanged) {
-          // The compacted rows stay visible (archived) above the divider.
-          const { items } = archiveItemsForCompaction(getState().items, compactDoneItem(result, startedAt), null, {
-            archived: compactionArchivedRows(result),
-          });
-          set({ items: replaceItems(items, { preserveSpill: true }) });
-        } else {
-          pushItem(compactDoneItem(result, startedAt));
-        }
-        return result;
-      });
+      return await withCommandStatus('Compacting conversation', 'compacting', (startedAt) => runCompaction(startedAt));
     } finally {
       // A command reply reads the published snapshot, not the draft. Commit
       // completion before the awaiting service constructs that reply.

package/src/tui/session/session-api/extensions.mjs

@@ -28,6 +28,13 @@ export function createSessionExtensionsApi(bag) {
       { busyError: 'Another command is still running; try again when it finishes.' }
     );
   const pluginLabel = (result, plugin) => result?.plugin?.title || result?.plugin?.name || plugin?.name || plugin;
+  // MCP OAuth sign-in methods the runtime must implement (no silent fallback).
+  const mcpOAuth =
+    (name) =>
+    (...args) => {
+      if (typeof runtime[name] !== 'function') throw new Error('MCP sign-in is unavailable');
+      return runtime[name](...args);
+    };
 
   return {
     mcpStatus: () => {
@@ -55,6 +62,19 @@ export function createSessionExtensionsApi(bag) {
       (name) => runtime.removeMcpServer?.(name),
       (_status, name) => [`mcp removed: ${name}`]
     ),
+    // Explicit OAuth sign-in: no command lock, the flow runs on the server's
+    // own connect lane and the caller polls its status. The caller (TUI app)
+    // owns the sign-in completion notice; the store never posts one.
+    beginMcpOAuthLogin: async (name, options) => {
+      const result = await mcpOAuth('beginMcpOAuthLogin')(name, options);
+      if (result?.state === 'pending') pushNotice(`mcp sign-in started: ${name}`, 'info');
+      return result;
+    },
+    getMcpOAuthLoginStatus: mcpOAuth('getMcpOAuthLoginStatus'),
+    cancelMcpOAuthLogin: mcpOAuth('cancelMcpOAuthLogin'),
+    completeMcpOAuthLogin: mcpOAuth('completeMcpOAuthLogin'),
+    signOutMcpServer: lockedChange(mcpOAuth('signOutMcpServer'), (_status, name) => [`mcp signed out: ${name}`]),
+    probeMcpServerAuth: mcpOAuth('probeMcpServerAuth'),
     setMcpServerEnabled: async (name, enabled) => {
       // No global commandBusy: the runtime adopts config synchronously and
       // serializes the heavy connect/close/recreate per server name, so rapid
@@ -70,6 +90,8 @@ export function createSessionExtensionsApi(bag) {
       const row = status?.servers?.find((s) => s.name === name);
       if (enabled && row && (row.status === 'failed' || row.error)) {
         pushNotice(`mcp enable failed: ${name}${row.error ? ` — ${row.error}` : ''}`, 'error');
+      } else if (enabled && row?.authRequired) {
+        pushNotice(`mcp enabled: ${name} — sign-in required`, 'warn');
       } else {
         pushNotice(`mcp ${enabled ? 'enabled' : 'disabled'}: ${name}`, 'info');
       }
@@ -83,8 +105,10 @@ export function createSessionExtensionsApi(bag) {
       }
       return await runtime.setExtensionScope(kind, name, projects);
     },
-    skillsStatus: () => {
-      return runtime.skillsStatus?.() || { cwd: getState().cwd, count: 0, skills: [] };
+    // `options.cwd`: list and scope skills for that folder instead of this
+    // session's (the desktop resolves a new-task draft's Project to it).
+    skillsStatus: (options) => {
+      return runtime.skillsStatus?.(options) || { cwd: getState().cwd, count: 0, skills: [] };
     },
     skillContent: (name) => {
       return runtime.skillContent?.(name);

package/src/tui/session/session-api/integrations.mjs

@@ -78,6 +78,13 @@ export function createSessionIntegrationsApi(bag, { oauthFlows }) {
         revision
       );
     },
+    clearSessionChangeHistory: async () => {
+      // A queued or running prompt/command may still be about to record changes.
+      if (getState().busy || getState().commandBusy) {
+        throw new Error('Change history cannot be deleted while this session is running a turn');
+      }
+      return await requireRuntimeMethod('clearSessionChangeHistory', 'Change history deletion is unavailable')();
+    },
     getOnboardingStatus: () => {
       return runtime.getOnboardingStatus?.() || { completed: true, workflowRoutes: {} };
     },

package/src/tui/session/session-api/lifecycle.mjs

@@ -8,6 +8,7 @@ import { createSessionResetActions } from './lifecycle/session-reset.mjs';
 import { createInheritanceActions } from './lifecycle/inheritance.mjs';
 import { createResumeAction } from './lifecycle/resume.mjs';
 import { createDisposeAction } from './lifecycle/dispose.mjs';
+import { publishModelSwitch } from './routes.mjs';
 
 export function createSessionLifecycleApi(bag, { restoreTranscriptItems, oauthFlows }) {
   const { runtime, pushNotice, removeNotice, setProgressHint, finishToolApproval } = bag;
@@ -85,9 +86,12 @@ export function createSessionLifecycleApi(bag, { restoreTranscriptItems, oauthFl
       bag.supersedeQuotaResume?.(sessionId);
       bag.set({ commandBusy: true });
       try {
-        await runtime.continueSessionInModel(sessionId, route);
+        const result = await runtime.continueSessionInModel(sessionId, route);
         bag.set({ ...bag.routeState(), stats: { ...bag.getState().stats } });
         bag.syncContextStats?.({ allowEstimated: true });
+        // The same live divider as a picker switch; IPC and remote callers
+        // see it through the published snapshot.
+        publishModelSwitch(bag, result?.modelSwitch);
         return true;
       } finally {
         bag.set({ commandBusy: false });

package/src/tui/session/session-api/routes.mjs

@@ -3,6 +3,9 @@
  * the serialized optimistic setRoute, web-search route, workflows, agent
  * definitions, output style and orchestration mode.
  */
+import { modelSwitchItem } from '../../../runtime/agent/orchestrator/session/transcript-restore/restore.mjs';
+import { selectedModel, switchesSessionModel } from '../../../session-runtime/model-route/model-switch-target.mjs';
+import { latestQuotaFailure } from '../quota-resume.mjs';
 import { createApiHelpers } from './shared.mjs';
 
 // Optimistic route preview: the requested provider/model/effort/fast are
@@ -47,6 +50,12 @@ function optimisticRoutePatch(requested = {}, current = {}) {
   return patch;
 }
 
+/** The live divider of an in-place model switch (restored from message meta
+ *  after a reload); every switch path publishes it the same way. */
+export function publishModelSwitch(bag, modelSwitch) {
+  if (modelSwitch) bag.pushItem(modelSwitchItem(bag.nextId(), modelSwitch));
+}
+
 export function createSessionRouteApi(bag) {
   const {
     runtime,
@@ -68,32 +77,84 @@ export function createSessionRouteApi(bag) {
   let routeWrite = null;
   let routeSequence = 0;
 
+  // A preset selector previews as the preset's model, never as its id.
+  const previewedRequest = (routeOpts) => {
+    if (routeOpts.provider || !routeOpts.model) return routeOpts;
+    const target = selectedModel(runtime, routeOpts, '', '');
+    return target.provider ? { ...routeOpts, ...target } : routeOpts;
+  };
+
+  // Auto-compact on model change (default on): compact on the CURRENT model,
+  // whose cache and window still hold the history, before the switch. A model
+  // stopped on its quota cannot run it; the next turn's auto-compaction on the
+  // new model fits the history instead. A failure never blocks the switch.
+  const compactBeforeModelSwitch = async () => {
+    if (runtime.getCompactionSettings?.()?.onModelChange === false) return;
+    if (latestQuotaFailure(getState().items)) return;
+    if (typeof bag.compactBeforeModelSwitch !== 'function') return;
+    set({
+      commandStatus: { active: true, verb: 'Compacting conversation', startedAt: Date.now(), mode: 'compacting' },
+    });
+    flushEmitImmediate();
+    try {
+      await bag.compactBeforeModelSwitch();
+    } catch {
+      /* the switch goes ahead; next-turn auto-compaction fits the window */
+    } finally {
+      set({ commandStatus: null });
+    }
+  };
+
   const setRoute = async (opts) => {
     if (getState().commandBusy && !routeWrite) return false;
+    const routeOpts = opts && typeof opts === 'object' ? opts : {};
+    // Every user model choice on this surface (composer picker, /model,
+    // presets, the TUI picker) switches the conversation itself in place.
+    const switchesModel = switchesSessionModel(runtime, routeOpts);
+    // A running turn keeps the route it started on.
+    if (switchesModel && getState().busy) {
+      throw new Error('The model cannot change while a response is running. Try again when it finishes.');
+    }
     // Any route change supersedes waiting for the old route's quota reset.
     bag.supersedeQuotaResume?.(getState().sessionId);
     const token = ++routeSequence;
     const previousWrite = routeWrite;
-    const routeOpts = opts && typeof opts === 'object' ? opts : {};
-    const preview = optimisticRoutePatch(routeOpts, getState());
+    const preview = optimisticRoutePatch(previewedRequest(routeOpts), getState());
     // Preview immediately, serialize persistence without dropping a later
     // click. Earlier completions cannot replace the newest visible choice.
-    set({ commandBusy: true, ...(preview || {}) });
+    // A model switch previews once its pre-compaction (which republishes the
+    // current route) is done.
+    set({ commandBusy: true, ...(switchesModel ? {} : preview || {}) });
     flushEmitImmediate();
     const write = (async () => {
       if (previousWrite) await previousWrite.catch(() => {});
       const previousRoute = routeState();
       try {
-        // Explicit addressing initializes an empty session in place; the
-        // runtime continues to own established-session route policy.
+        // Explicit addressing applies the route to this session: an empty
+        // one is initialized in place. Either way an established
+        // conversation follows the user's choice in place.
         const applyToCurrentSession = routeOpts.applyToCurrentSession === true;
         const keepMainModel = routeOpts.keepMainModel === true;
         const { applyToCurrentSession: _drop, keepMainModel: _keep, ...nextRoute } = routeOpts;
-        const resolvedRoute = await runtime.setRoute(nextRoute, { applyToCurrentSession, keepMainModel });
+        if (switchesModel) {
+          // The destination must be accepted before the history is compacted.
+          await runtime.setRoute(nextRoute, { validateOnly: true });
+          await compactBeforeModelSwitch();
+          if (token === routeSequence && preview) {
+            set(preview);
+            flushEmitImmediate();
+          }
+        }
+        const resolvedRoute = await runtime.setRoute(nextRoute, {
+          applyToCurrentSession,
+          keepMainModel,
+          switchEstablished: true,
+        });
         if (token === routeSequence) {
-          if (applyToCurrentSession) syncContextStats({ allowEstimated: true });
+          if (applyToCurrentSession || resolvedRoute?.modelSwitch) syncContextStats({ allowEstimated: true });
           publishRoute();
         }
+        publishModelSwitch(bag, resolvedRoute?.modelSwitch);
         return resolvedRoute;
       } catch (error) {
         if (token === routeSequence && preview) {
@@ -116,6 +177,9 @@ export function createSessionRouteApi(bag) {
       if (routeWrite === write) routeWrite = null;
     }
   };
+  // The settings surface's setModel (/model, presets) is the same user
+  // model choice and runs through this one path.
+  bag.setSessionRoute = setRoute;
 
   const setWebSearchRoute = async (opts) => {
     if (getState().commandBusy) return null;

package/src/tui/session/session-api/settings.mjs

@@ -28,20 +28,11 @@ export function createSessionSettingsApi(bag) {
   const lockedRuntimeCall = (call) => withCommandLock(async (...args) => await call(...args));
 
   return {
-    // Model changes apply to the NEXT session only (default setRoute behavior)
-    // — never rewrite the live session's provider/model, which would force a
-    // full prompt-cache rewrite mid-conversation. RPC replies read the
-    // published snapshot, not the mutable draft: commit before the caller can
-    // acknowledge an older route.
-    setModel: withCommandLock(
-      async (m) => {
-        bag.supersedeQuotaResume?.(getState().sessionId);
-        await runtime.setRoute({ model: m });
-        publishRoute();
-        return true;
-      },
-      { busyResult: false, onRelease: flushEmitImmediate }
-    ),
+    // A model selector (/model, a preset) is the user's model choice like any
+    // picker selection: the route surface switches an established
+    // conversation in place (pre-compaction, busy refusal, divider). False
+    // while another command holds the lock.
+    setModel: async (m) => (await bag.setSessionRoute({ model: m })) !== false,
     setEffort: withCommandLock(
       async (value) => {
         await runtime.setEffort(value);
@@ -154,6 +145,13 @@ export function createSessionSettingsApi(bag) {
     inspectHuggingFaceModel: (options) => runtime.inspectHuggingFaceModel(options),
     registerHuggingFaceModel: (previewId, licenseAccepted) =>
       runtime.registerHuggingFaceModel(previewId, licenseAccepted),
+    // Conversation import (advertised session actions; one object argument).
+    // Background jobs, so never behind commandBusy.
+    listImportableConversations: (params) => runtime.listImportableConversations(params),
+    getConversationImportJobs: (params) => runtime.getConversationImportJobs(params),
+    registerConversationImportFile: (params) => runtime.registerConversationImportFile(params),
+    startConversationImport: (params) => runtime.startConversationImport(params),
+    cancelConversationImport: (params) => runtime.cancelConversationImport(params),
     getChannelSettings: (options = {}) => {
       return (
         runtime.getChannelSettings?.(options) || {

package/src/tui/session/session-flow/drain.mjs

@@ -65,7 +65,19 @@ function renderBatchItems(batch, pushUserOrSyntheticItem) {
   }
 }
 
-function turnOptionsForBatch(batch, steering) {
+const COMPLETION_WAKE_MODES = new Set(['task-notification', 'pending-resume']);
+
+// Trusted provenance of a drained batch: Goal turns keep their own source; a
+// batch made only of completion wakes (task notifications, pending resumes)
+// is the runtime reporting, carried as a task notification so the runtime
+// stores it as one and never treats its text as a user skill selection.
+function batchPromptSource(batch) {
+  if (isGoalQueuedEntry(batch[0])) return batch[0].mode;
+  if (batch.length > 0 && batch.every((entry) => COMPLETION_WAKE_MODES.has(entry?.mode))) return 'task-notification';
+  return undefined;
+}
+
+export function turnOptionsForBatch(batch, steering) {
   const nonEditable = batch.filter((entry) => !isQueuedEntryEditable(entry));
   // A completion resume is owned by the completion that woke it. Esc
   // consumes that ownership; unlike ordinary notifications it must never
@@ -75,7 +87,7 @@ function turnOptionsForBatch(batch, steering) {
     (entry) => entry?.abortDiscardOnAbort === true || entry?.mode === 'pending-resume'
   );
   return {
-    promptSource: isGoalQueuedEntry(batch[0]) ? batch[0].mode : undefined,
+    promptSource: batchPromptSource(batch),
     retryFailedTurn: batch[0]?.retryFailedTurn === true,
     displayText: batch
       .map((entry) => entry.text)
@@ -114,8 +126,6 @@ function turnOptionsForBatch(batch, steering) {
   };
 }
 
-const COMPLETION_WAKE_MODES = new Set(['task-notification', 'pending-resume']);
-
 export function createDrainLoop(
   bag,
   { queue, steering, submissions, flushDeferredClearedSessionUi, autoClearBeforeWake }
@@ -238,6 +248,12 @@ export function createDrainLoop(
       while (pending.length > 0) {
         if (flags.drainEpoch !== drainEpoch) return;
         if (admission() !== 'open') return;
+        // Admission is rechecked before every batch: a command that took the
+        // lock while the previous turn settled (an in-place model switch and
+        // its pre-compaction, a reset) runs before the next turn starts. The
+        // finally below re-enters drain(), which waits on the same gate, and
+        // the commandBusy release re-kicks the queue.
+        if (flags.autoClearRunning || getState().commandBusy) return;
         // Drain one priority/mode bucket at a time (unified command queue):
         // prompt steering stays editable and task notifications stay
         // non-editable but model-visible.
@@ -257,7 +273,7 @@ export function createDrainLoop(
         // after a long idle is compacted first; the wake runs regardless.
         if (autoClearBeforeWake && batch.every((entry) => COMPLETION_WAKE_MODES.has(entry.mode))) {
           await autoClearBeforeWake();
-          if (flags.drainEpoch !== drainEpoch || admission() !== 'open') {
+          if (flags.drainEpoch !== drainEpoch || admission() !== 'open' || getState().commandBusy) {
             queue.requeueEntriesFront(batch);
             return;
           }

package/src/tui/session/session-flow/failed-turn-rewind.mjs

@@ -5,8 +5,12 @@
 // prompt, so a continuation prompt or a merged batch never removes rows.
 const TURN_CHROME_KINDS = new Set(['user', 'turndone', 'notice']);
 
-/** The items with the trailing failed, output-less turn removed, or null
- *  when nothing qualifies. */
+// An in-place model switch made after the stop (the quota "switch model"
+// path) is not the failed turn's output and outlives its rewind.
+const isModelSwitchDivider = (item) => item?.kind === 'statusdone' && item.status === 'model-switched';
+
+/** The items with the trailing failed, output-less turn removed (a later
+ *  model switch divider kept), or null when nothing qualifies. */
 export function rewoundFailedTurnItems(items, text) {
   const list = Array.isArray(items) ? items : [];
   const resubmitted = String(text || '').trim();
@@ -16,6 +20,8 @@ export function rewoundFailedTurnItems(items, text) {
   const tail = list.slice(start + 1);
   const failed = tail.some((item) => item?.kind === 'turndone' && String(item.status || '').toLowerCase() === 'failed');
   if (!failed) return null;
-  if (tail.some((item) => !TURN_CHROME_KINDS.has(String(item?.kind || '')))) return null;
-  return list.slice(0, start);
+  if (tail.some((item) => !TURN_CHROME_KINDS.has(String(item?.kind || '')) && !isModelSwitchDivider(item))) {
+    return null;
+  }
+  return [...list.slice(0, start), ...tail.filter(isModelSwitchDivider)];
 }

package/src/tui/session/tui-steering-persist.mjs

@@ -15,11 +15,19 @@ const STALE_STEERING_RESTORE_TTL_MS = 30 * 60 * 1000;
 // Cross-process mutual exclusion still comes from the shared lock protocol;
 // this chain only orders same-process operations that were previously
 // naturally ordered by the synchronous call site.
-let _persistChain = Promise.resolve();
-function _serialize(task) {
-  const run = _persistChain.then(task, task);
+// One chain per session key so a slow write for one session never delays
+// another; an entry is removed once its chain is idle.
+const _persistChains = new Map();
+function _serialize(key, task) {
+  const prev = _persistChains.get(key) || Promise.resolve();
+  const run = prev.then(task, task);
   // Never let a rejection poison the chain; each op logs its own error.
-  _persistChain = run.catch(() => {});
+  const tail = run
+    .catch(() => {})
+    .then(() => {
+      if (_persistChains.get(key) === tail) _persistChains.delete(key);
+    });
+  _persistChains.set(key, tail);
   return run;
 }
 
@@ -159,7 +167,7 @@ export function appendTuiSteeringPersist(leadSessionId, entry) {
     ...(submissionId ? { submissionId } : {}),
     ...(Number.isFinite(submittedAt) && submittedAt > 0 ? { submittedAt } : {}),
   };
-  return _serialize(async () => {
+  return _serialize(key, async () => {
     try {
       await updatePendingShard(key, (raw) => {
         const next = normalizePendingStore(raw);
@@ -184,7 +192,7 @@ export function dropTuiSteeringPersist(leadSessionId, entries) {
   if (!key) return Promise.resolve();
   const batch = Array.isArray(entries) ? entries : [];
   if (batch.length === 0) return Promise.resolve();
-  return _serialize(async () => {
+  return _serialize(key, async () => {
     try {
       await updatePendingShard(key, (raw) => {
         const next = normalizePendingStore(raw);
@@ -207,8 +215,16 @@ export function dropTuiSteeringPersist(leadSessionId, entries) {
   });
 }
 
-export function flushTuiSteeringPersist() {
-  return _persistChain.catch(() => {});
+export async function flushTuiSteeringPersist() {
+  // Loop: chains started while waiting are awaited too.
+  while (_persistChains.size > 0) {
+    await Promise.all([..._persistChains.values()]);
+  }
+}
+
+// Test hook: number of live per-key chains.
+export function _steeringPersistChainCount() {
+  return _persistChains.size;
 }
 
 function drainedRowToRestore(row) {
@@ -233,7 +249,7 @@ function drainedRowToRestore(row) {
 export function drainTuiSteeringPersist(leadSessionId) {
   const key = tuiSteeringSessionKey(leadSessionId);
   if (!key) return Promise.resolve([]);
-  return _serialize(async () => {
+  return _serialize(key, async () => {
     let drained = [];
     let droppedStale = 0;
     try {