mixdog 1.2.2 → 1.2.3

package/src/session-runtime/lifecycle/session-switch/session-delete.mjs

@@ -5,7 +5,12 @@
  */
 import { clean } from '../../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
 import { forgetSessionSearch } from '../../../runtime/session-search/session-search-ingest.mjs';
-import { listLeadSessions } from '../session-catalog.mjs';
+import { leadSessionRow } from '../session-catalog.mjs';
+import { getStoreDir } from '../../../runtime/agent/orchestrator/session/store/paths-heartbeat.mjs';
+import {
+  STORED_SESSION_UNREADABLE,
+  _storedSessionFromFile,
+} from '../../../runtime/agent/orchestrator/session/store/serialize.mjs';
 import { SESSION_ID_PATTERN } from '../shared.mjs';
 import { replacementSessionCwd } from '../../workspace/workspace-state.mjs';
 
@@ -50,6 +55,15 @@ export function createSessionDelete(deps, { cancelBackgroundTasks }) {
     }
   }
 
+  // Availability is one strict read of the session's own file, filtered like
+  // the Lead catalog (an unreadable, foreign, closed or non-Lead record is not
+  // deletable). No catalog rebuild, no folder scan.
+  function isAvailableLead(sessionId) {
+    const stored = _storedSessionFromFile(getStoreDir(), `${sessionId}.json`);
+    if (!stored || stored === STORED_SESSION_UNREADABLE || stored.closed === true) return false;
+    return leadSessionRow(stored, new Map()) !== null;
+  }
+
   // The deleted task's worktree: the autoCleanup setting decides (clean and
   // merged → removed; otherwise kept). Off the deletion path; never fails it.
   function releaseDeletedWorktree(sessionId) {
@@ -61,12 +75,18 @@ export function createSessionDelete(deps, { cancelBackgroundTasks }) {
   async function deleteSession(id) {
     const sessionId = clean(id);
     if (!sessionId || !SESSION_ID_PATTERN.test(sessionId)) return false;
-    const available = listLeadSessions(mgr, { refreshFromStorage: true }).some((row) => row.id === sessionId);
-    if (!available) return false;
+    if (!isAvailableLead(sessionId)) return false;
     const childIds = ownedAgentSessionIds(sessionId);
     const current = getSession();
+    const cleanupReason = 'desktop-session-delete';
     if (current?.id !== sessionId) {
-      const deleted = mgr.deleteSession(sessionId) === true;
+      // A turn can still be running in a session that is no longer current.
+      // Stop its runtime first (controller abort, shells, generation bump) and
+      // release its lead row, agents and tasks, so nothing can write it back.
+      if (mgr.closeSession(sessionId, cleanupReason, { tombstone: false }) !== true) return false;
+      agentTool?.forgetLeadSession?.(sessionId);
+      releaseSessionWork(sessionId, cleanupReason);
+      const deleted = mgr.deleteSession(sessionId, { fenceWrites: true }) === true;
       if (!deleted) return false;
       void forgetSessionSearch(sessionId);
       // The parent is already irreversibly gone, so child cleanup is
@@ -74,7 +94,7 @@ export function createSessionDelete(deps, { cancelBackgroundTasks }) {
       // because its retained-parent proof disappeared with the parent.
       for (const childId of childIds) {
         try {
-          mgr.deleteSession(childId);
+          mgr.deleteSession(childId, { fenceWrites: true });
         } catch {}
       }
       void releaseDeletedWorktree(sessionId);
@@ -83,12 +103,15 @@ export function createSessionDelete(deps, { cancelBackgroundTasks }) {
     // Leaving a worktree-bound Lead: the replacement starts in the Project
     // folder, and the worktree can go once nothing runs in it.
     const projectFolder = replacementSessionCwd(current);
-    const cleanupReason = 'desktop-session-delete';
     releaseSessionWork(sessionId, cleanupReason);
     // Active sessions retain a tombstone until the normal sweep. Unlinking
     // immediately would let a late provider/save continuation resurrect the
     // deleted conversation after the user has moved to its replacement.
     if (mgr.closeSession(sessionId, cleanupReason, { tombstone: true }) !== true) return false;
+    // The unwinding turn's late saves and its idle lead-row upsert must not
+    // touch the deleted conversation (an unguarded save would pass the tombstone).
+    mgr.fenceSessionWrites?.(sessionId);
+    agentTool?.forgetLeadSession?.(sessionId);
     void forgetSessionSearch(sessionId);
     // Active parent deletion uses the same durable tombstone boundary for
     // every linked child. Their files then mature with the parent instead of

package/src/session-runtime/lifecycle/teardown.mjs

@@ -7,11 +7,13 @@
  */
 import { SessionClosedError } from '../../runtime/agent/orchestrator/session/manager/session-errors.mjs';
 import { forgetSessionSaveBaseline } from '../../runtime/agent/orchestrator/session/store/save-worker.mjs';
+import { flushAllIndexWrites } from '../services/agent-tool/index-write-queue.mjs';
 import { unregisterLiveSession } from '../../runtime/shared/staged-update.mjs';
 import { abortRuntime, closeCanonicalSession, closeOwnSession, dispatchSessionEnd } from './teardown/session-close.mjs';
 import { settleAll, settleDetached, startRuntimeStops, startWorkStops } from './teardown/runtime-stops.mjs';
 
-const PROCESS_EXIT_REASON = /exit|quit|shutdown|sighup|sigint|sigterm/;
+const CLOSE_ALL_DEADLINE_MS = 5000;
+const PROCESS_EXIT_REASON =/exit|quit|shutdown|sighup|sigint|sigterm/;
 const WARMUP_TIMER_KEYS = [
   'providerSetupWarmupTimer',
   'providerWarmupTimer',
@@ -118,6 +120,45 @@ export function createTeardown(deps, { ingestSessionIntoMemory, closeSurfaceSess
     } catch {}
   }
 
+  // Agent closes that have not settled yet (one per close invocation, kept
+  // past the bounded wait if it overran).
+  const outstandingCloses = new Set();
+
+  /** Persist every queued index write. A close only ever drains: the shared
+   *  indexes stay registered (exit hook included) for the closes still to come. */
+  async function drainIndexWrites() {
+    try {
+      await agentTool.flushIndexWrites?.();
+      await flushAllIndexWrites();
+    } catch {}
+  }
+
+  // The disposal in progress (if any). New closes wait for it before starting
+  // their own closeAll, so no close produces writes while registrations are
+  // being released.
+  let indexDisposal = null;
+
+  /** Release this runtime's per-runtime index registrations (exit callbacks,
+   *  approval writer, store refs) once its drain has completed. Idempotent. A
+   *  drain that cannot complete tears nothing down: the registrations stay until
+   *  a later close drains successfully. Exit flushing itself is process-owned. */
+  function disposeIndexes(settle) {
+    // Assign before disposal runs (deferred), clear on settlement: a synchronous
+    // dispose must not clear the slot before it is assigned.
+    indexDisposal ??= Promise.resolve()
+      .then(async () => {
+        if (typeof agentTool.disposeAsync === 'function') await agentTool.disposeAsync({ settle });
+        else agentTool.dispose?.({ settle });
+      })
+      .catch(() => {
+        /* drain failed: registrations are kept for a later retry */
+      })
+      .finally(() => {
+        indexDisposal = null;
+      });
+    return indexDisposal;
+  }
+
   async function close(reason = 'cli-exit', options = {}) {
     quiesce(reason);
     const scope = teardownScope(reason, options, String(getSession()?.id || ''));
@@ -160,16 +201,40 @@ export function createTeardown(deps, { ingestSessionIntoMemory, closeSurfaceSess
     // memory and must leave workers/rows for the re-materialized owner.
     // Scoped teardown closes only THIS session's workers — the worker index
     // is shared across every Lead in the process.
+    let closing = null;
+    while (indexDisposal) await indexDisposal;
     if (scope.teardownReapsWork) {
+      // Every close runs its OWN scope's closeAll: a scoped close for one Lead
+      // never stands in for a process-wide close. Closing produces final index
+      // writes (settled rows, tombstones); the deadline only bounds how long
+      // teardown waits and does not stop the close.
+      const settled = () => {
+        outstandingCloses.delete(closing);
+      };
+      closing = new Promise((resolve) =>
+        resolve(agentTool.closeAll(reason, scope.scopedTeardown ? { callerSessionId: scope.closingSessionId } : {}))
+      ).then(settled, settled);
+      outstandingCloses.add(closing);
       try {
-        agentTool.closeAll(reason, scope.scopedTeardown ? { callerSessionId: scope.closingSessionId } : {});
+        await withTeardownDeadline(closing, CLOSE_ALL_DEADLINE_MS, false);
       } catch {}
     }
-    // Release the worker/lead index exit registrations (persists pending rows
-    // first). Idempotent, so repeated closes of one runtime dispose once.
-    try {
-      agentTool.dispose?.({ settle: scope.teardownReapsWork === true });
-    } catch {}
+    // Drain after the closes settle, then release this runtime's index
+    // registrations. A close that overran its deadline chains this onto its
+    // settlement (teardown may return before then). The live outstanding set is
+    // re-checked after every wait and drain, so the single disposal runs only
+    // when no close is outstanding; the check and the disposal start share one
+    // tick, and closes admitted afterwards wait for it.
+    const finish = async () => {
+      for (;;) {
+        while (outstandingCloses.size > 0) await Promise.allSettled([...outstandingCloses]);
+        await drainIndexWrites();
+        if (outstandingCloses.size === 0) break;
+      }
+      await disposeIndexes(scope.teardownReapsWork === true);
+    };
+    if (outstandingCloses.size > 0) void finish();
+    else await finish();
     const { ok, stops } = await inOwnLoopTurn(() => {
       const runtimeStops = startRuntimeStops(deps, reason, scope);
       const closed = closeOwnSession(deps, closeSurfaceSession, reason);

package/src/session-runtime/lifecycle-api.mjs

@@ -42,5 +42,6 @@ export function createLifecycleApi(deps) {
     resume: switching.resume,
     inheritancePreflight: inheritance.inheritancePreflight,
     inheritFrom: inheritance.inheritFrom,
+    inheritToNewSession: inheritance.inheritToNewSession,
   };
 }

package/src/session-runtime/mcp-glue/connect.mjs

@@ -209,19 +209,31 @@ export function createMcpConnect({
         budgetMs = Math.min(budgetMs, requestedMaxWaitMs);
       }
     }
-    // Swallow the in-flight rejection: failures are already captured in
-    // state.mcpFailures, and this gate must never reject the turn.
-    const settled = Promise.resolve(inFlight).catch(() => {});
     // Budget disabled (0/off) = no per-server startup timeout, so the connect
     // promise may never settle; never gate the turn on it — fall back to the
     // legacy fire-and-forget behavior (late servers use the deferred path).
     if (!(budgetMs > 0)) return;
     let timer = null;
+    let expired = false;
     const budget = new Promise((resolveBudget) => {
-      timer = setTimeout(resolveBudget, budgetMs);
+      timer = setTimeout(() => {
+        expired = true;
+        resolveBudget();
+      }, budgetMs);
     });
     try {
-      await Promise.race([settled, budget]);
+      // Follow replacement connects (a reconnect queued behind the captured
+      // run installs a new in-flight promise) inside ONE fixed deadline.
+      // Failures are already captured in state.mcpFailures, so rejections are
+      // swallowed: this gate must never reject the turn.
+      let current = inFlight;
+      while (current && !expired) {
+        await Promise.race([Promise.resolve(current).catch(() => {}), budget]);
+        if (expired) break;
+        // Let a queued reconnect install its promise before re-checking.
+        await Promise.race([new Promise((resolveTick) => setImmediate(resolveTick)), budget]);
+        current = state.mcpConnectInFlight;
+      }
     } finally {
       if (timer) clearTimeout(timer);
     }

package/src/session-runtime/model-route/set-route.mjs

@@ -20,7 +20,7 @@ import {
   sessionRouteCommitted,
   shouldRecreateEmptySessionForRouteChange,
 } from '../../runtime/agent/orchestrator/runtime-core/session-route-policy.mjs';
-import { rebuildDeferredToolSurfaceForProvider } from '../../runtime/agent/orchestrator/runtime-core/tool-catalog.mjs';
+import { rebuildToolSurfaceForProviderWithMigration } from '../../runtime/agent/orchestrator/session/loop/tool-exposure-migration.mjs';
 
 /** The request, completed from the live route where the caller left gaps. */
 function completeRequest(deps, next) {
@@ -114,7 +114,7 @@ function updateSessionInPlace(deps, session, updateOptions) {
   const updated = mgr.updateSessionRoute?.(session.id, fields, updateOptions);
   if (updated) setSession(updated);
   else Object.assign(session, fields);
-  rebuildDeferredToolSurfaceForProvider(getSession(), route.provider);
+  rebuildToolSurfaceForProviderWithMigration(getSession(), route.provider);
   writeStatuslineRoute(statusRoutes, getSession(), route);
 }
 

package/src/session-runtime/native-web-search-usage.mjs

@@ -0,0 +1,51 @@
+// Per-session sink for usage spent by native web-search sends. The search runs
+// as its own provider send under a derived session id, so the main stream
+// never reports it; a turn's caller opts in with `onNativeWebSearchUsage` and
+// receives the same delta shape `onUsageDelta` carries.
+//
+// Keyed by the owning session id, not async-local state: tools can execute
+// from stream callbacks whose async context belongs to a pooled transport
+// connection, not to the ask that is waiting on them.
+//
+// Each registration is its own entry that only its own release removes, so
+// overlapping turns on one session id never restore or drop each other. The
+// session lock serializes turns, so the most recent live entry belongs to the
+// turn that is running; callers register once their turn owns the session.
+import { usageDeltaEvent } from '../runtime/agent/orchestrator/session/loop/usage.mjs';
+
+const entriesBySession = new Map();
+
+/** Adds an owned sink entry for `sessionId`; the returned release removes exactly that entry. */
+export function registerNativeWebSearchUsageSink(sessionId, sink) {
+  if (typeof sink !== 'function' || !sessionId) return () => {};
+  const entry = { sink };
+  let entries = entriesBySession.get(sessionId);
+  if (!entries) {
+    entries = [];
+    entriesBySession.set(sessionId, entries);
+  }
+  entries.push(entry);
+  return () => {
+    const live = entriesBySession.get(sessionId);
+    const index = live ? live.indexOf(entry) : -1;
+    if (index === -1) return;
+    live.splice(index, 1);
+    if (live.length === 0) entriesBySession.delete(sessionId);
+  };
+}
+
+export function reportNativeWebSearchUsage({ ownerSessionId, sessionId, requestedModel, model, usage }) {
+  const entries = entriesBySession.get(ownerSessionId);
+  const sink = entries?.[entries.length - 1]?.sink;
+  if (!sink || !usage) return;
+  try {
+    const pending = sink({
+      ...usageDeltaEvent({ sessionId, iterationIndex: 0, requestedModel, model, usage }),
+      source: 'native_web_search',
+      agentRole: 'web-search',
+    });
+    if (typeof pending?.then === 'function') pending.then(undefined, () => {});
+  } catch {
+    /* telemetry must never fail the search */
+  }
+}

package/src/session-runtime/native-web-search.mjs

@@ -13,6 +13,7 @@ import {
   normalizeWebSearchAllowedDomain,
 } from './native-web-search/tool-shape.mjs';
 import { createWebSearchRouteCandidates } from './native-web-search/routes.mjs';
+import { reportNativeWebSearchUsage } from './native-web-search-usage.mjs';
 
 export function createNativeWebSearch(deps) {
   const {
@@ -58,10 +59,11 @@ export function createNativeWebSearch(deps) {
     }
     const family = webSearchProviderFamily(candidate.provider);
     const startedAt = Date.now();
+    const sendSessionId = `${getSession()?.id || 'web_search'}:native-web-search:${Date.now().toString(36)}`;
     const result = await providerImpl.send(nativeWebSearchMessages(webSearchArgs), candidate.model, undefined, {
       signal,
       role: 'web-search',
-      sessionId: `${getSession()?.id || 'web_search'}:native-web-search:${Date.now().toString(36)}`,
+      sessionId: sendSessionId,
       sourceType: 'native-web-search',
       sourceName: 'web_search',
       nativeTools: [toolFor(webSearchArgs, toolType, candidate.provider)],
@@ -73,6 +75,13 @@ export function createNativeWebSearch(deps) {
       onStageChange: () => {},
       onStreamDelta: () => {},
     });
+    reportNativeWebSearchUsage({
+      ownerSessionId: getSession()?.id,
+      sessionId: sendSessionId,
+      requestedModel: candidate.model,
+      model: result?.model || candidate.model,
+      usage: result?.usage,
+    });
     return {
       content: String(result?.content || '').trim(),
       provider: candidate.provider,

package/src/session-runtime/new-session-config.mjs

@@ -12,7 +12,6 @@ export function createNewSessionConfig({
   initialRouteExplicit = false,
   invalidatePreSessionToolSurface,
   invalidateOutputStyleStatusCache,
-  invalidateSkills,
   connectConfiguredMcp,
   configureEmbedding,
 }) {
@@ -33,7 +32,10 @@ export function createNewSessionConfig({
     }
     invalidateOutputStyleStatusCache();
     invalidatePreSessionToolSurface();
-    invalidateSkills();
+    // The installed-skill list is NOT dropped here: its cache is change-gated
+    // (every skill root's mtime signature, kept by change watchers), so a new
+    // session already sees any skill edit. Clearing it made every session
+    // creation re-read and re-parse every SKILL.md on the event loop.
     await configureEmbedding(sharedCfgMod.readSection('memory')?.embedding || {});
     if (!firstSession || !isDeepStrictEqual(previousMcp, mcpSettings())) {
       // Reused runtimes may still own old connections. This reset is scoped to

package/src/session-runtime/provider-auth/login.mjs

@@ -12,6 +12,7 @@ import {
   removeCustomProvider,
   updateCustomProviderModel,
   testCustomProvider,
+  checkCustomProviderKeyEnv,
   discoverCustomProviderModels,
 } from '../services/provider-admin.mjs';
 
@@ -96,6 +97,9 @@ export function createLoginApi({ cfgMod, awaitKeychainPrewarm, reloadFullConfig,
       await awaitKeychainPrewarm();
       return await testCustomProvider(cfgMod, input);
     },
+    checkCustomProviderKeyEnv(name) {
+      return checkCustomProviderKeyEnv(name);
+    },
     async discoverCustomProviderModels(input) {
       await awaitKeychainPrewarm();
       return await discoverCustomProviderModels(cfgMod, input);

package/src/session-runtime/resource-scope-decorate.mjs

@@ -14,8 +14,13 @@ function listOf(status, key) {
 }
 
 export function createScopeDecorators({ getConfig, getCurrentCwd }) {
-  function scopeInfo(kind, name, pluginId = '', cwd = getCurrentCwd()) {
-    const scopes = extensionScopesFromConfig(getConfig());
+  function scopeInfo(
+    kind,
+    name,
+    pluginId = '',
+    cwd = getCurrentCwd(),
+    scopes = extensionScopesFromConfig(getConfig())
+  ) {
     const scope = extensionScopeProjects(scopes, kind, name);
     const inheritedScope = pluginId ? extensionScopeProjects(scopes, 'plugins', pluginId) : null;
     const activeHere =
@@ -35,11 +40,13 @@ export function createScopeDecorators({ getConfig, getCurrentCwd }) {
     },
     /** `cwd`: decide `activeHere` for that folder instead of the current one. */
     skills(status, cwd = getCurrentCwd()) {
+      // One scope read for the whole list, not one per skill.
+      const scopes = extensionScopesFromConfig(getConfig());
       return {
         ...status,
         skills: listOf(status, 'skills').map((skill) => ({
           ...skill,
-          ...scopeInfo('skills', skill.name, skill?.owner?.kind === 'plugin' ? clean(skill.owner.id) : '', cwd),
+          ...scopeInfo('skills', skill.name, skill?.owner?.kind === 'plugin' ? clean(skill.owner.id) : '', cwd, scopes),
         })),
       };
     },

package/src/session-runtime/runtime-review-api.mjs

@@ -3,8 +3,10 @@ import { turnReviewReply } from '../runtime/shared/turn-review-reply.mjs';
 import {
   clearSessionChangeHistory,
   getSessionReviewDiff,
+  getSessionReviewFilePatch,
   getTurnChanges,
   getTurnReviewDiff,
+  getTurnReviewFilePatch,
   reapplyTurnChanges,
   revertTurnChanges,
   revertTurnReview,
@@ -24,8 +26,9 @@ registerSessionPurgeHook((sessionId) => {
 });
 
 // Tool writes (apply_patch, mutating shell commands, git, watcher events)
-// reach the live review snapshot as its change signal: a review poll right
-// after them captures the worktree, an unsignaled poll may reuse the last one.
+// reach the turn's worktree snapshot as its change signal: a session review
+// read right after them captures the worktree, an unsignaled one may reuse
+// the last capture.
 registerCacheInvalidationListener((paths) => noteTurnWorktreeChange(paths));
 
 export function createRuntimeReviewApi({ getCwd, getSessionId }) {
@@ -35,6 +38,9 @@ export function createRuntimeReviewApi({ getCwd, getSessionId }) {
     getTurnReviewDiff: (options = {}) =>
       turnReviewReply((reviewOptions) => getTurnReviewDiff(getCwd(), getSessionId(), reviewOptions), options),
     getSessionReviewDiff: () => getSessionReviewDiff(getCwd(), getSessionId()),
+    // One listed file's whole patch (a reply lists a large one `patchOmitted`).
+    getSessionReviewFilePatch: (file, oldPath) => getSessionReviewFilePatch(getCwd(), getSessionId(), file, oldPath),
+    getTurnReviewFilePatch: (file) => getTurnReviewFilePatch(getCwd(), getSessionId(), file),
     revertTurnReview: (checkpointId) => revertTurnReview(getCwd(), getSessionId(), checkpointId),
     revertTurnReviewFile: (file, checkpointId) => revertTurnReviewFile(getCwd(), getSessionId(), file, checkpointId),
     // Historical per-turn changes, addressed by checkpointId (TurnChangesReply).

package/src/session-runtime/services/agent-tool/index-write-queue.mjs

@@ -20,6 +20,7 @@ import { registerJsonProjection } from '../../../runtime/shared/pending-json-pro
 import { sleep } from '../../../runtime/shared/sleep.mjs';
 
 const RETRY_DELAYS_MS = [50, 250, 1000];
+const RETRY_AFTER_FAILURE_MS = 15_000;
 const unsettled = new Set(); // queues holding unpersisted writes
 // Exit is the one place a bounded synchronous lock wait is acceptable: the
 // loop is gone, and a dropped settlement would leave rows "running" forever.
@@ -122,8 +123,15 @@ function replayBatch(batch, args, mergeSet) {
   replayRun();
 }
 
+// A write that cannot reach disk loses a state change other processes rely on
+// (e.g. a deleted Lead row that never leaves the pool), so every failure is
+// reported. In the daemon stderr IS daemon.log (daemon-log.mjs installRedirect).
 function reportFailure(file, what, error) {
-  process.stderr.write(`[index-write] ${file}: ${what}: ${error?.message || error}\n`);
+  try {
+    process.stderr.write(`[index-write] ${file}: ${what}: ${error?.message || error}\n`);
+  } catch {
+    /* logging is best effort */
+  }
 }
 
 /**
@@ -151,9 +159,15 @@ export function createIndexWriteQueue({
   let pending = []; // op sets not yet handed to a job
   let inflight = []; // op sets of the running job
   let running = null;
+  const failures = new WeakMap(); // settled job → the error that failed it
   let timer = null;
+  let retryTimer = null;
 
   function clearTimer() {
+    if (retryTimer) {
+      clearTimeout(retryTimer);
+      retryTimer = null;
+    }
     if (!timer) return;
     clearImmediate(timer);
     timer = null;
@@ -173,8 +187,8 @@ export function createIndexWriteQueue({
         return;
       } catch (error) {
         if (attempt >= RETRY_DELAYS_MS.length) {
-          reportFailure(file, `dropped ${batch.length} unpersisted write(s)`, error);
-          return;
+          reportFailure(file, `${batch.length} unpersisted write(s) kept queued after retries`, error);
+          throw error;
         }
         await sleep(RETRY_DELAYS_MS[attempt]);
       }
@@ -187,23 +201,45 @@ export function createIndexWriteQueue({
     inflight = pending;
     pending = [];
     const batch = inflight;
-    running = persist(batch).then(() => {
-      inflight = [];
-      running = null;
-      onPersisted();
-      if (pending.length === 0) {
-        projection = null;
-        unsettled.delete(self);
+    const job = persist(batch).then(
+      () => {
+        inflight = [];
+        running = null;
+        onPersisted();
+        if (pending.length === 0) {
+          projection = null;
+          unsettled.delete(self);
+        }
+        schedule();
+      },
+      (error) => {
+        // Persistent failure: nothing reached disk. Requeue the batch ahead of
+        // newer writes (the projection and `unsettled` keep covering it) so a
+        // later flush, write or exit flush retries. Do not reschedule at once,
+        // a held foreign lock would otherwise be hammered; a slow unref'd retry
+        // keeps a failed LAST write (a delete) from waiting for unrelated traffic.
+        failures.set(job, error);
+        pending = [...batch, ...pending];
+        inflight = [];
+        running = null;
+        retryTimer = setTimeout(() => {
+          retryTimer = null;
+          schedule();
+        }, RETRY_AFTER_FAILURE_MS);
+        retryTimer.unref?.();
       }
-      schedule();
-    });
+    );
+    running = job;
   }
 
-  /** Resolves once everything written so far is on disk (or dropped). */
+  /** Resolves once everything written so far is on disk; rejects when a persist
+   *  failed for good (the writes stay queued for a later flush). */
   async function flush() {
     for (;;) {
       if (running) {
-        await running;
+        const job = running;
+        await job;
+        if (failures.has(job)) throw failures.get(job);
         continue;
       }
       if (pending.length === 0) return;
@@ -212,10 +248,16 @@ export function createIndexWriteQueue({
     }
   }
 
-  /** Exit path: persist inflight + pending ops synchronously (bounded lock wait). */
+  /** Persist pending ops synchronously (bounded lock wait). While an async job
+   *  runs it owns the lock (and its ops are in flight): never wait on it, take
+   *  over its lock, or replay its ops — report false and let that job and its
+   *  follow-ups drain. At the last-resort process 'exit' hook that is
+   *  best-effort: the graceful shutdown path drains before exit. */
   function flushSync() {
-    const ops = [...inflight, ...pending];
-    if (!file || ops.length === 0) return true;
+    if (!file) return true;
+    if (running) return false;
+    const ops = pending;
+    if (ops.length === 0) return true;
     clearTimer();
     pending = [];
     try {
@@ -225,10 +267,10 @@ export function createIndexWriteQueue({
       });
     } catch (error) {
       reportFailure(file, `synchronous flush of ${ops.length} write(s) failed; kept queued`, error);
-      pending = ops;
+      pending = [...ops, ...pending];
+      schedule();
       return false;
     }
-    inflight = [];
     projection = null;
     unsettled.delete(self);
     onPersisted();
@@ -251,9 +293,11 @@ export function createIndexWriteQueue({
         version += 1;
         pending.push(rerun ? mutator : ops);
         unsettled.add(self);
+        installProcessExitFlush();
         schedule();
         return next;
-      } catch {
+      } catch (error) {
+        reportFailure(file, 'write rejected (mutator or document rewrite threw); nothing queued', error);
         return null;
       }
     },
@@ -266,6 +310,23 @@ export function createIndexWriteQueue({
   };
 }
 
+let processExitFlushInstalled = false;
+
+/** The process owns last-resort exit flushing of every queue holding unpersisted
+ *  writes, so a disposed (e.g. evicted) runtime needs no exit callback of its
+ *  own. Best effort: a persist still running is left to the graceful drain. */
+function installProcessExitFlush() {
+  if (processExitFlushInstalled) return;
+  processExitFlushInstalled = true;
+  process.on('exit', () => {
+    try {
+      flushAllIndexWritesSync();
+    } catch {
+      /* exit flush is best effort */
+    }
+  });
+}
+
 /** Synchronous variant (exit paths, tests that read the file directly). */
 export function flushAllIndexWritesSync() {
   for (const queue of [...unsettled]) queue.flushSync();

package/src/session-runtime/services/agent-tool/lead-worker-index/forgotten-leads.mjs

@@ -0,0 +1,29 @@
+// Ids of deleted Leads, shared by every lead-index instance of the process that
+// uses one data dir. The delete runs in the control runtime while the deleted
+// session's own (still loaded) runtime keeps settling turns through ITS index
+// instance; a per-instance set never sees the delete, so that late idle upsert
+// wrote the row back. The store's write fence (explicit deletes) is consulted
+// as well, so a fenced id can never be added whichever instance asks.
+import { resolve } from 'node:path';
+import { isSessionWriteFenced } from '../../../../runtime/agent/orchestrator/session/store/live-state.mjs';
+
+const FORGOTTEN_LEADS_MAX = 1024;
+const registries = new Map(); // resolved data dir -> Set<sessionId>
+
+export function createForgottenLeads(dataDir) {
+  const key = dataDir ? resolve(dataDir) : '';
+  let ids = registries.get(key);
+  if (!ids) {
+    ids = new Set();
+    registries.set(key, ids);
+  }
+  return {
+    /** A deleted Lead must never be written to the index again. */
+    forget(sessionId) {
+      ids.delete(sessionId);
+      ids.add(sessionId);
+      if (ids.size > FORGOTTEN_LEADS_MAX) ids.delete(ids.values().next().value);
+    },
+    isForgotten: (sessionId) => ids.has(sessionId) || isSessionWriteFenced(sessionId),
+  };
+}

package/src/session-runtime/services/agent-tool/lead-worker-index/index-file.mjs

@@ -42,7 +42,7 @@ export function createLeadIndexFile({ dataDir }) {
     return parsed ? normalizeLeadRows(parsed) : [];
   }
 
-  const write = (mutator) => queue.write(mutator);
+  const write = (mutator, options) => queue.write(mutator, options);
 
   return { path, read, write, flush: queue.flush, flushSync: queue.flushSync };
 }