mixdog 1.2.1 → 1.2.3

package/src/session-runtime/workspace/transitions.mjs

@@ -12,7 +12,9 @@
  * (runtime/shared/worktrees/manager.mjs), loaded on first use.
  */
 import { randomUUID } from 'node:crypto';
+import { isDeepStrictEqual } from 'node:util';
 import {
+  WORKTREE_CARRY_CHOICES,
   branchMenuEntries,
   isWorktreeBound,
   isWorktreeError,
@@ -24,6 +26,7 @@ import { normalizeWorktreeSettings } from '../../runtime/shared/worktrees/settin
 import * as maintenance from '../../runtime/shared/worktrees/maintenance.mjs';
 import { inspectRepo, throwIfAborted } from '../../runtime/shared/worktrees/git.mjs';
 import { isWithin, samePath } from '../../runtime/shared/worktrees/paths.mjs';
+import { readGitHead } from '../../runtime/shared/worktrees/git-head.mjs';
 import { sessionHasConversationMessages } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
 import { buildWorkspacePromptContext } from '../../runtime/agent/orchestrator/session/manager/session-prompt-composition.mjs';
 import {
@@ -53,6 +56,9 @@ async function defaultOwnShellJobCount(sessionIds) {
 
 const lower = (value) => String(value || '').toLowerCase();
 
+const WORKTREE_BOUND_SWITCH =
+  'The session works in a managed worktree; exit the worktree first (switch to a project-folder branch, or merge or remove the worktree) before moving it to another project.';
+
 /** The registered Project (projects.json) at `path`, or null. */
 async function defaultRegisteredProject(path) {
   const { listProjectsStrict } = await import('../../runtime/shared/projects.mjs');
@@ -62,9 +68,12 @@ async function defaultRegisteredProject(path) {
 /**
  * Re-root one session's prompt at `cwd`: environment facts and instruction
  * files for every session, project memory for the Lead only (workers never
- * carried it).
+ * carried it). A session with a conversation keeps its system prompt (cache
+ * intact) and gets a tail notice instead (refreshSessionWorkspaceContext);
+ * `move` ({ from, changes }: the session left the project folder `from` for
+ * a worktree) adds the uncommitted-changes and path lines to that notice.
  */
-export async function refreshWorkspacePrompt(session, cwd, { loadCoreMemoryContext } = {}) {
+export async function refreshWorkspacePrompt(session, cwd, { loadCoreMemoryContext, move = null } = {}) {
   const { environmentContext, instructionFilesContext } = buildWorkspacePromptContext(session, cwd);
   const coreMemoryContext =
     session?.owner === AGENT_OWNER || typeof loadCoreMemoryContext !== 'function'
@@ -75,6 +84,7 @@ export async function refreshWorkspacePrompt(session, cwd, { loadCoreMemoryConte
     environmentContext,
     coreMemoryContext,
     instructionFilesContext,
+    ...(move ? { move } : {}),
   });
 }
 
@@ -137,9 +147,10 @@ const TRANSITION_STATE = { worktree: 'provisioning', branch: 'switching', 'remov
  * @param {object} deps
  * @param {() => any} deps.getSession The Lead session this runtime hosts.
  * @param {() => string} deps.getCurrentCwd
- * @param {(cwd: string) => unknown} deps.applyResolvedCwd Retargets rt cwd, session.cwd and the cwd override.
+ * @param {(cwd: string, options?: { persistProjectSelection?: boolean }) => unknown} deps.applyResolvedCwd Retargets rt cwd, session.cwd and the cwd override (and, persisting, the Project selection).
+ * @param {(desktopSession: any) => unknown} [deps.setDesktopSession] Restores the runtime's desktop metadata on a rollback.
  * @param {(session: any) => unknown} deps.persistSession
- * @param {(session: any, cwd: string) => Promise<unknown>} deps.refreshWorkspaceContext
+ * @param {(session: any, cwd: string, move?: { from: string, changes: 'carried'|'left'|null }|null) => Promise<unknown>} deps.refreshWorkspaceContext
  * @param {() => number} deps.getActiveTurnCount
  * @param {() => { agentWorkers?: any[], agentJobs?: any[] }} deps.agentStatusState
  * @param {(sessionId: string, cwd: string) => unknown} [deps.updateLeadWorkerCwd] Moves the Lead's pool row (lead-workers.json).
@@ -149,6 +160,7 @@ export function createWorkspaceTransitions({
   getReservedSessionId = () => null,
   getCurrentCwd,
   getDesktopSession = () => null,
+  setDesktopSession = () => {},
   getConfig = () => null,
   createCurrentSession = null,
   applyResolvedCwd,
@@ -207,6 +219,37 @@ export function createWorkspaceTransitions({
     return normalizeSessionWorkspace({ projectPath, cwd: getCurrentCwd() || projectPath, revision: 0 });
   }
 
+  let liveWorkspace = null;
+
+  /**
+   * The workspace the session publishes: a worktree-bound record as stored; a
+   * project-folder session (never moved, back from a worktree, or carrying a
+   * transition stub) with the folder's checked-out branch / detached commit and
+   * repoCommonDir read straight from HEAD — no git process. Null outside a git
+   * repository for a session without a record. Identity-stable while equal.
+   */
+  function getLiveWorkspace() {
+    const session = getSession();
+    const stored = readSessionWorkspace(session);
+    if (isWorktreeBound(stored)) return session.workspace;
+    let base;
+    try {
+      base = stored ?? currentWorkspace(session);
+    } catch {
+      return session?.workspace ?? null;
+    }
+    const head = readGitHead(base.cwd);
+    if (!head) return session?.workspace ?? null;
+    const next = {
+      ...base,
+      repoCommonDir: head.repoCommonDir,
+      branch: head.branch,
+      baseCommit: head.branch ? base.baseCommit : head.commit,
+    };
+    if (!liveWorkspace || !isDeepStrictEqual(liveWorkspace, next)) liveWorkspace = next;
+    return liveWorkspace;
+  }
+
   function isSessionActive(session) {
     const runtime = sessionManager?.getSessionRuntime?.(session.id);
     if (runtime?.controller?.signal && !runtime.controller.signal.aborted) return true;
@@ -223,8 +266,11 @@ export function createWorkspaceTransitions({
         (candidate.ownerSessionId === session.id || candidate.parentSessionId === session.id)
     );
 
-  /** WORKTREE_BUSY_JOBS while this Lead has a turn, workers or background shells running. */
-  async function assertLeadIdle(session, { ownTurn = false } = {}) {
+  /**
+   * WORKTREE_BUSY_JOBS while this Lead has a turn, workers or background
+   * shells running (`shellJobs: false` tolerates background shells).
+   */
+  async function assertLeadIdle(session, { ownTurn = false, shellJobs: checkShellJobs = true } = {}) {
     if (!ownTurn && getActiveTurnCount() > 0) {
       throw worktreeError('WORKTREE_BUSY_JOBS', 'The session is running a turn; wait for it to finish.', {
         reason: 'turn',
@@ -240,6 +286,7 @@ export function createWorkspaceTransitions({
     if (busyWorkers || busyJobs) {
       throw worktreeError('WORKTREE_BUSY_JOBS', undefined, { reason: 'workers', workers: busyWorkers, jobs: busyJobs });
     }
+    if (!checkShellJobs) return;
     const ids = new Set([session.id, ...workers.map((row) => row?.sessionId).filter(Boolean)]);
     for (const worker of workersOf(session)) ids.add(worker.id);
     const shellJobs = await countOwnShellJobs([...ids]);
@@ -284,11 +331,44 @@ export function createWorkspaceTransitions({
     }
   }
 
+  /**
+   * Before a carry clears the shared checkout `folder` (held by the caller,
+   * so no new turn starts there): WORKTREE_BUSY_JOBS while any other session
+   * working in it — idle or not, this Lead's workers included — owns a
+   * running background shell (holdProjectFolder already refused running
+   * turns and agents there, assertLeadIdle this Lead's own). Processes
+   * outside Mixdog (editors, watchers) cannot be excluded.
+   */
+  async function assertCheckoutQuiet(session, folder) {
+    const sharing = listLiveSessions()
+      .filter(
+        (candidate) =>
+          candidate?.id &&
+          candidate.id !== session.id &&
+          candidate.closed !== true &&
+          typeof candidate.cwd === 'string' &&
+          isWithin(folder, candidate.cwd)
+      )
+      .map((candidate) => candidate.id);
+    if (!sharing.length) return;
+    const shellJobs = await countOwnShellJobs(sharing);
+    if (shellJobs > 0) {
+      throw worktreeError(
+        'WORKTREE_BUSY_JOBS',
+        'Background shells of other sessions are running in the project folder; carrying the changes needs it quiet.',
+        { reason: 'folder-shell-jobs', shellJobs }
+      );
+    }
+  }
+
   const steps = createTransitionSteps({
+    assertCheckoutQuiet,
     backend,
     inspectProject,
     runtimeToken,
     getCurrentCwd,
+    getDesktopSession,
+    setDesktopSession,
     applyResolvedCwd,
     persistSession,
     refreshWorkspaceContext,
@@ -331,6 +411,7 @@ export function createWorkspaceTransitions({
           name: target.name,
           nameHint: options.nameHint,
           confirmLarge: options.confirmLarge,
+          changes: options.changes,
         });
       }
       if (target.kind === 'branch') {
@@ -442,9 +523,22 @@ export function createWorkspaceTransitions({
     });
     // A session in the project folder (never moved, or back from a worktree)
     // is on whatever that folder has checked out now.
-    const checkedOut = menu.occupancy.find((row) => row.kind === 'current')?.branch ?? null;
+    // Its repository is the project's (a never-moved session has no stored
+    // record), and a detached checkout shows branch null with the commit in
+    // baseCommit — never mistaken for "not a repository".
+    let view = workspace;
+    if (!isWorktreeBound(workspace)) {
+      const project = await inspectProject(workspace.projectPath);
+      const checkedOut = project.currentBranch ?? null;
+      view = {
+        ...workspace,
+        repoCommonDir: project.repoCommonDir ?? workspace.repoCommonDir,
+        branch: checkedOut,
+        baseCommit: checkedOut ? workspace.baseCommit : (project.headCommit ?? null),
+      };
+    }
     return {
-      workspace: isWorktreeBound(workspace) || !checkedOut ? workspace : { ...workspace, branch: checkedOut },
+      workspace: view,
       pendingWorktree: pendingIntent ? { name: pendingIntent.name } : null,
       branches: branchMenuEntries(menu.branches, menu.occupancy),
       occupancy: menu.occupancy,
@@ -510,17 +604,28 @@ export function createWorkspaceTransitions({
    * reuse it. Typed failures (large repository, disk, busy) therefore reach
    * the sender while its draft is still unsent, and the turn that follows
    * finds the session already bound.
+   *
+   * A provisioning that creates a new worktree decides the project folder's
+   * uncommitted changes (tracked and untracked): none → it proceeds; without
+   * `carryChanges` it refuses with WORKTREE_DIRTY_CHOICE (`details.count`);
+   * `leave` starts the worktree at HEAD and leaves them; `carry` moves them
+   * into it (the result's `changes` reports which). Re-entering a retained
+   * worktree never touches them.
    */
   async function requestWorktree({
     name = null,
     confirmLarge = false,
     provision = false,
+    carryChanges,
     prompt = '',
     txId = '',
     expectedRevision,
   } = {}) {
     const nameHint = validName(name);
     const expected = validRevision(expectedRevision);
+    if (carryChanges !== undefined && carryChanges !== null && !WORKTREE_CARRY_CHOICES.includes(carryChanges)) {
+      throw new TypeError(`carryChanges must be one of ${WORKTREE_CARRY_CHOICES.join(', ')}.`);
+    }
     const session = provision === true ? await ensureSession() : getSession();
     // No session yet: the menu it was read from had revision 0.
     const current = session?.id ? currentWorkspace(session) : null;
@@ -536,6 +641,7 @@ export function createWorkspaceTransitions({
         return { ...entered, pending: false };
       }
     }
+    const priorIntent = pendingIntent;
     pendingIntent = {
       name: nameHint ?? pendingIntent?.name ?? null,
       confirmLarge: confirmLarge === true || pendingIntent?.confirmLarge === true,
@@ -544,10 +650,21 @@ export function createWorkspaceTransitions({
       txId: pendingIntent?.txId ?? null,
     };
     if (provision === true) {
-      return {
-        ...(await provisionIntent(session, pendingIntent, txId, prompt, { expectedRevision: expected })),
-        pending: false,
-      };
+      const intent = pendingIntent;
+      try {
+        return {
+          ...(await provisionIntent(session, intent, txId, prompt, {
+            expectedRevision: expected,
+            changes: carryChanges ?? 'ask',
+          })),
+          pending: false,
+        };
+      } catch (error) {
+        // A refused move (uncommitted changes to decide, busy, …) is never
+        // re-armed for the next turn, where nobody could answer it.
+        if (pendingIntent === intent) pendingIntent = priorIntent;
+        throw error;
+      }
     }
     const workspace = session?.id ? currentWorkspace(session) : null;
     return { revision: workspace?.revision ?? 0, workspace, pending: true };
@@ -570,15 +687,35 @@ export function createWorkspaceTransitions({
     if (cleanup !== true || merged.merged !== true) return merged;
     // "Merge and clean up": with autoCleanup on, the merged worktree goes now
     // (a dirty one stays, reported); off, nothing is removed automatically.
+    // The merge is committed: a failed or refused cleanup (dirty, retained
+    // file recovery data, ...) is a cleanup notice, never a merge failure.
     if (worktreeSettings().autoCleanup !== true) {
-      return { ...merged, cleanup: { removed: false, reason: 'auto-cleanup-off' } };
+      return {
+        ...merged,
+        cleanup: { removed: false, reason: 'auto-cleanup-off', message: 'Auto cleanup is off; the worktree is kept.' },
+      };
     }
     try {
       const removed = await removeWorktree({ force: false }, { ownTurn });
       return { ...merged, cleanup: removed.removed, revision: removed.revision, workspace: removed.workspace };
     } catch (error) {
-      if (!isWorktreeError(error, 'WORKTREE_DIRTY') && !isWorktreeError(error, 'WORKTREE_UNMERGED')) throw error;
-      return { ...merged, cleanup: { removed: false, reason: error.code } };
+      // The merge stands: a refused or incomplete cleanup (dirty, unmerged,
+      // retained file recovery data, partly removed, …) is reported, never
+      // thrown, with the workspace as it is now (an incomplete removal already
+      // returned to the project folder).
+      const workspace = currentWorkspace(session);
+      const code = typeof error?.code === 'string' ? error.code : '';
+      return {
+        ...merged,
+        cleanup: {
+          removed: false,
+          reason: code || 'WORKTREE_CLEANUP_FAILED',
+          ...(code ? { code } : {}),
+          message: String(error?.message || error),
+        },
+        revision: workspace.revision,
+        workspace,
+      };
     }
   }
 
@@ -620,6 +757,41 @@ export function createWorkspaceTransitions({
     }
   }
 
+  /**
+   * Move the hosted Lead to another Project folder (session set-project, the
+   * desktop/remote setCwd): the one authority for a Project switch, admitted
+   * like a workspace transition. Refused while a turn runs (`ownTurn`: the
+   * Lead's own tool call tolerates its calling turn), while workers run, and
+   * while the session works in a managed worktree. Serialized with turns and
+   * other workspace changes; the prompt refresh of the Lead and its idle
+   * workers completes (or rolls the switch back) before it resolves. Without
+   * a session (a draft) only the runtime cwd and the selection move.
+   * `classifyByMembership` (the desktop/remote move): a folder outside every
+   * registered Project is classified as a task (cwd-apply).
+   * @returns {Promise<string>} the runtime cwd after the switch
+   */
+  async function switchProject(cwd, { ownTurn = false, classifyByMembership = false } = {}) {
+    const selection = { classifyByMembership: classifyByMembership === true };
+    const session = getSession();
+    if (!session?.id) {
+      applyResolvedCwd(cwd, { persistProjectSelection: true, ...selection });
+      return getCurrentCwd();
+    }
+    const leave = beginWorkspaceTransition(session.id, `project:${newTxId()}`);
+    const journal = [];
+    try {
+      await assertLeadIdle(session, { ownTurn: ownTurn === true, shellJobs: false });
+      if (isWorktreeBound(readSessionWorkspace(session))) throw new Error(WORKTREE_BOUND_SWITCH);
+      await steps.switchProject(session, cwd, journal, selection);
+      return getCurrentCwd();
+    } catch (error) {
+      await undoAll(journal, error);
+      throw error;
+    } finally {
+      leave();
+    }
+  }
+
   async function removeWorktree({ force = false, expectedRevision } = {}, { ownTurn = false } = {}) {
     const expected = validRevision(expectedRevision);
     const session = hostedSession(null);
@@ -636,6 +808,8 @@ export function createWorkspaceTransitions({
     admitTurnWorkspace,
     /** The durable workspace record of the hosted session (null: project folder, never moved). */
     getWorkspace: () => getSession()?.workspace ?? null,
+    /** What the session snapshot publishes (see getLiveWorkspace). */
+    getLiveWorkspace,
     getBranchMenu,
     getProjectBranchMenu: projectBranches.getProjectBranchMenu,
     selectBranch,
@@ -644,6 +818,7 @@ export function createWorkspaceTransitions({
     requestWorktree,
     mergeWorkspace,
     removeWorktree,
+    switchProject,
     listWorktrees,
     pruneWorktrees,
     cleanupDeletedSession,

package/src/standalone/daemon-agent-control.mjs

@@ -68,5 +68,13 @@ export function createCanonicalAgentControl({ getSessionService, getSessionRunti
     return await tool.execute(args, scopedContext);
   }
 
-  return { canonicalAgentTool, execute };
+  /** Graceful shutdown: drain and release the canonical agent's index writers.
+   *  Never builds the tool just to dispose it. */
+  async function dispose() {
+    if (!canonicalAgentToolPromise) return;
+    const tool = await canonicalAgentToolPromise.catch(() => null);
+    await tool?.disposeAsync?.({ settle: true });
+  }
+
+  return { canonicalAgentTool, execute, dispose };
 }

package/src/standalone/daemon-drain-policy.mjs

@@ -1,3 +1,11 @@
+/** Whether an idle GC sweep may start: no service call and no running turn
+ *  (provider stream / tool call). Background-task-only sessions and memory
+ *  agents do not block it — unlike drainDeferral, which guards shutdown. */
+export function idleGcEligible(work) {
+  const { activeCalls = 0, queuedCalls = 0, turnBusySessions = 0 } = work || {};
+  return !(activeCalls > 0 || queuedCalls > 0 || turnBusySessions > 0);
+}
+
 /** Whether self-shutdown must wait for in-flight work. A forced replacement
  *  never waits: shutdown() aborts busy sessions, service calls and agent runs. */
 export function drainDeferral(work, { force = false } = {}) {

package/src/standalone/daemon-local-session-bridge.mjs

@@ -22,9 +22,22 @@ export function createLocalSessionBridge({ getSessionService, log, pid = process
       return createSessionProtocolClient({
         call(name, args = {}, options = {}) {
           if (closed) throw new Error('daemon-local session client is closed');
-          return getSessionService().handleCall(name, args, {
+          const signal = options?.signal;
+          signal?.throwIfAborted();
+          const result = getSessionService().handleCall(name, args, {
             clientToken,
             ...(options?.callId ? { callId: String(options.callId) } : {}),
+            ...(signal ? { signal } : {}),
+          });
+          if (!signal) return result;
+          // The in-process service has no cancellation of its own: an abort
+          // frees the caller, whose late reply is dropped.
+          return new Promise((resolve, reject) => {
+            const onAbort = () => reject(signal.reason);
+            signal.addEventListener('abort', onAbort, { once: true });
+            Promise.resolve(result)
+              .then(resolve, reject)
+              .finally(() => signal.removeEventListener('abort', onAbort));
           });
         },
         async close(reason = 'local session view closed') {

package/src/standalone/daemon-owner.mjs

@@ -246,6 +246,7 @@ export function daemonOwnerIsStale(
  * - No successful refresh for `fenceMs`: fenced, never renewed (`onFenced`).
  * - The record names another pid: `onSuperseded(record)`.
  * - A turn gap over `stallMs`: `admit()` refuses work until a refresh succeeds.
+ *   The gap is logged once, with `describeStall(fromMono, toMono)` appended.
  * Both callbacks must make this process stop serving.
  */
 export function createOwnerHeartbeat({
@@ -259,6 +260,7 @@ export function createOwnerHeartbeat({
   monoNow = () => performance.now(),
   refresh = refreshSingletonOwner,
   log = () => {},
+  describeStall = null,
   onBeat = () => {},
   onSuperseded,
   onFenced,
@@ -290,11 +292,22 @@ export function createOwnerHeartbeat({
   }
 
   function noteTurn(t) {
-    if (t - lastTurnAt > stallMs && !needsVerify) {
-      needsVerify = true;
-      log(`event loop stalled ${Math.round(t - lastTurnAt)}ms — owner lease must be re-verified before serving`);
-    }
+    const from = lastTurnAt;
+    // Rebased before reporting: one long block is one gap, however many
+    // callers (tick, admit) observe it afterwards.
     lastTurnAt = t;
+    if (t - from <= stallMs) return;
+    needsVerify = true;
+    let detail = '';
+    try {
+      detail = describeStall?.(from, t) || '';
+    } catch {
+      /* attribution must not disturb the lease */
+    }
+    log(
+      `event loop stalled ${Math.round(t - from)}ms — owner lease must be re-verified before serving` +
+        (detail ? ` | ${detail}` : '')
+    );
   }
 
   function beat() {

package/src/standalone/daemon-pg-stop.mjs

@@ -0,0 +1,51 @@
+// The daemon's PostgreSQL stop inside its shutdown. The normal teardown stops
+// PostgreSQL after every user of it has closed, letting durable writes still in
+// flight commit first; a fallback timer stops it regardless just before the
+// launcher's kill (PG_FORCED_STOP_AT_MS), because a daemon killed before
+// `pg_ctl stop` leaves the daemonized postmaster running.
+import { PG_FORCED_STOP_AT_MS } from './daemon-stop-budget.mjs';
+
+const ADAPTER = '../runtime/memory/lib/pg/adapter.mjs';
+
+/**
+ * Arm at shutdown start. `finish()` is the ordered teardown step: it drains
+ * durable writes until the fallback point, then stops. Idempotent: whichever
+ * of finish/fallback comes first runs the one stop; the other joins it.
+ */
+export function createDaemonPgStop({
+  log,
+  stopTimeoutMs,
+  forcedStopAtMs = PG_FORCED_STOP_AT_MS,
+  loadAdapter = () => import(ADAPTER),
+}) {
+  const startedAt = Date.now();
+  let stopping = null;
+  // The drain budget is what remains until the fallback point once the adapter
+  // has loaded, so a slow load never stretches the drain past that point.
+  const drainBudget = () => Math.max(0, startedAt + forcedStopAtMs - Date.now());
+  const run = (drain) => {
+    stopping ??= loadAdapter()
+      .then(({ shutdownOwnedPg }) =>
+        shutdownOwnedPg({ timeoutMs: stopTimeoutMs, drainMs: drain ? drainBudget() : 0 })
+      )
+      .then(
+        (stopped) => {
+          if (stopped) log('postgres stopped');
+        },
+        (e) => log(`postgres stop failed: ${e?.message || e}`)
+      );
+    return stopping;
+  };
+  const fallback = setTimeout(() => {
+    if (stopping) return; // the ordered stop is draining; its bound is this same point
+    log(`teardown still running ${forcedStopAtMs}ms into shutdown; stopping postgres before the launcher's kill`);
+    void run(false);
+  }, forcedStopAtMs);
+  fallback.unref?.();
+  return {
+    finish() {
+      clearTimeout(fallback);
+      return run(true);
+    },
+  };
+}

package/src/standalone/daemon-stop-budget.d.mts

@@ -0,0 +1,2 @@
+export const IN_TREE_DAEMON_STOP_GRACE_MS: number;
+export const PG_FORCED_STOP_AT_MS: number;

package/src/standalone/daemon-stop-budget.mjs

@@ -0,0 +1,18 @@
+// Time budget of an in-tree daemon's stop, shared by the launcher that waits
+// for it (desktop quit) and the daemon that has to finish inside it.
+
+/** How long a launcher waits for an in-tree daemon to exit after asking it to
+ *  stop. Past this the launcher exits and the daemon dies with its process
+ *  tree — on Windows without any exit hook. A healthy daemon stop (PostgreSQL
+ *  included) measures ~0.6 s; the rest is room for a slow teardown to finish
+ *  its writes. The desktop window is hidden before this wait begins. */
+export const IN_TREE_DAEMON_STOP_GRACE_MS = 5_000;
+
+/** `pg_ctl stop` spawn + signal delivery. Once signalled, the postmaster
+ *  finishes its shutdown on its own even if the daemon is then killed. */
+const PG_STOP_SIGNAL_MARGIN_MS = 800;
+
+/** Fallback point (from shutdown start) at which the daemon stops PostgreSQL
+ *  even while earlier teardown steps still run: just before the launcher's
+ *  kill, so a slow-but-healthy teardown keeps its writes until then. */
+export const PG_FORCED_STOP_AT_MS = IN_TREE_DAEMON_STOP_GRACE_MS - PG_STOP_SIGNAL_MARGIN_MS;

package/src/standalone/daemon-stored-session-views.mjs

@@ -38,6 +38,8 @@ export function createStoredSessionViews({ desktopRuntime, dataDir }) {
       const review = createRuntimeReviewApi({ getCwd: () => metadata.cwd || '', getSessionId: () => sessionId });
       // The runtime review API answers `known`/`summary` itself (turnReviewReply).
       if (action === 'getSessionReviewDiff') return review.getSessionReviewDiff();
+      if (action === 'getSessionReviewFilePatch') return review.getSessionReviewFilePatch(args[0], args[1]);
+      if (action === 'getTurnReviewFilePatch') return review.getTurnReviewFilePatch(args[0]);
       // A cold session runs no turn: its change record is final.
       if (action === 'getTurnChanges') return review.getTurnChanges(args[0]);
       return review.getTurnReviewDiff(args[0]);

package/src/standalone/daemon-telemetry.mjs

@@ -93,6 +93,71 @@ export function collectDaemonTelemetry({
   };
 }
 
+/**
+ * Tracks the smallest heapUsed observed right after a major GC (mark-sweep-
+ * compact) — the retained-set size, which heapUsed at an arbitrary instant
+ * hides. Sampled per telemetry interval; no per-GC logging. Returns null when
+ * PerformanceObserver is unavailable.
+ */
+export function createPostGcHeapTracker({
+  heapUsed = () => v8.getHeapStatistics().used_heap_size,
+  observe = (onGc) => {
+    const obs = new PerformanceObserver((list) => {
+      for (const entry of list.getEntries()) onGc(entry);
+    });
+    obs.observe({ entryTypes: ['gc'] });
+    return () => obs.disconnect();
+  },
+} = {}) {
+  let min = -1;
+  let disconnect = null;
+  try {
+    disconnect = observe((entry) => {
+      // NODE_PERFORMANCE_GC_MAJOR = 4 (older Node: entry.kind); newer: entry.detail.kind.
+      const kind = entry?.detail?.kind ?? entry?.kind;
+      if (kind !== 4) return;
+      const used = byteCount(heapUsed());
+      if (used >= 0 && (min < 0 || used < min)) min = used;
+    });
+  } catch {
+    return null;
+  }
+  return {
+    /** Min post-major-GC heap since the last take; -1 when none ran. */
+    take() {
+      const value = min;
+      min = -1;
+      return value;
+    },
+    stop() {
+      try {
+        disconnect?.();
+      } catch {
+        /* already gone */
+      }
+    },
+  };
+}
+
+/**
+ * Builds the `describeStall(fromMono, toMono)` the owner heartbeat appends to
+ * its stall line: the spans that overlapped the stall window plus the in-flight
+ * work snapshot at report time. Counters and labels only.
+ */
+export function createStallDescriber({ spans, getWork = () => ({}), limit = 3 } = {}) {
+  return (fromMono, toMono) => {
+    const parts = [];
+    const overlapping = spans?.describe(fromMono, toMono, limit);
+    if (overlapping) parts.push(overlapping);
+    const work = workCounts(getWork());
+    parts.push(
+      `in-flight: activeCalls=${work.activeCalls} queuedCalls=${work.queuedCalls}` +
+        ` busySessions=${work.busySessions} busyMemoryAgents=${work.busyMemoryAgents}`
+    );
+    return parts.join(' | ');
+  };
+}
+
 export function formatDaemonTelemetry(record, reason = 'periodic') {
   const row = record && typeof record === 'object' ? record : collectDaemonTelemetry();
   return [
@@ -110,6 +175,8 @@ export function formatDaemonTelemetry(record, reason = 'periodic') {
     `queuedCalls=${row.queuedCalls}`,
     `busySessions=${row.busySessions}`,
     `busyMemoryAgents=${row.busyMemoryAgents}`,
+    // Present only when a major GC ran since the previous line.
+    ...(byteCount(row.postGcHeapMinBytes) >= 0 ? [`postGcHeapMinBytes=${row.postGcHeapMinBytes}`] : []),
   ].join(' ');
 }
 
@@ -123,8 +190,10 @@ export function createDaemonTelemetry({
   heapStatistics,
   setIntervalFn = setInterval,
   clearIntervalFn = clearInterval,
+  createGcTracker = createPostGcHeapTracker,
 } = {}) {
   let timer = null;
+  let gcTracker = null;
 
   function emit(reason = 'periodic') {
     try {
@@ -141,6 +210,8 @@ export function createDaemonTelemetry({
         heapStatistics,
         work,
       });
+      const postGc = gcTracker?.take() ?? -1;
+      if (postGc >= 0) record.postGcHeapMinBytes = postGc;
       log(formatDaemonTelemetry(record, reason));
       return record;
     } catch {
@@ -159,6 +230,7 @@ export function createDaemonTelemetry({
 
   function start(intervalMs = DAEMON_TELEMETRY_INTERVAL_MS) {
     if (timer) return timer;
+    gcTracker ??= createGcTracker();
     const delay = Number(intervalMs);
     const ms = Number.isFinite(delay) && delay > 0 ? delay : DAEMON_TELEMETRY_INTERVAL_MS;
     const handle = setIntervalFn(() => {
@@ -174,6 +246,8 @@ export function createDaemonTelemetry({
     if (!timer) return;
     clearIntervalFn(timer);
     timer = null;
+    gcTracker?.stop();
+    gcTracker = null;
   }
 
   return { emit, start, stop };