mixdog 1.2.2 → 1.2.4

package/src/standalone/channel-transport.mjs

@@ -8,10 +8,9 @@
 // (targeted routing, never broadcast — see channel-transport/remote-notify.mjs).
 //
 // This module owns ONLY the transport (sockets, client registry, notify
-// routing and lifecycle). The channels runtime (tool dispatch,
-// Discord provider, transcript bind/steal) is injected via `handleCall` so the
-// same transport is exercised by the real daemon entry AND the smoke harness
-// (stub runtime, no Discord token).
+// routing and lifecycle). The channels runtime is injected via `handleCall`
+// so the same transport is exercised by the real daemon entry AND the smoke
+// harness (stub runtime, no Discord token).
 //
 // Composition root: the shared transport state below is read and written by
 // the sub-services in channel-transport/ (remote binding, client registry,

package/src/standalone/daemon-agent-control.mjs

@@ -68,5 +68,13 @@ export function createCanonicalAgentControl({ getSessionService, getSessionRunti
     return await tool.execute(args, scopedContext);
   }
 
-  return { canonicalAgentTool, execute };
+  /** Graceful shutdown: drain and release the canonical agent's index writers.
+   *  Never builds the tool just to dispose it. */
+  async function dispose() {
+    if (!canonicalAgentToolPromise) return;
+    const tool = await canonicalAgentToolPromise.catch(() => null);
+    await tool?.disposeAsync?.({ settle: true });
+  }
+
+  return { canonicalAgentTool, execute, dispose };
 }

package/src/standalone/daemon-desktop-runtime.mjs

@@ -8,7 +8,31 @@
 // created after this surface is handed to the session service).
 // Output: the desktopRuntime object consumed by session-service.
 
+/** The stored-session reader, with the Agents pool's running state taken from
+ *  this daemon's in-memory turn activity (every session runs inline here, so
+ *  it is the single source of truth; worker index files only declare work). */
+async function loadSessionStoreWithRuntimeActivity() {
+  const [store, runtime, progress] = await Promise.all([
+    import('../runtime/agent/orchestrator/session/store-summary-reader.mjs'),
+    // The import-free leaf holding the runtime map: no session manager graph.
+    import('../runtime/agent/orchestrator/session/manager/runtime-state.mjs'),
+    import('../runtime/agent/orchestrator/session/agent-pool-progress.mjs'),
+  ]);
+  return {
+    ...store,
+    // Running rows also carry their turn's progress stamp and stage (the
+    // quiet-time cue), read from the same runtime map.
+    listStoredAgentWorkers: () =>
+      progress.withTurnProgress(
+        store.listStoredAgentWorkers({ runningSessionIds: runtime.inFlightSessionActivity().working }),
+        (sessionId) => runtime.runtimeState.get(sessionId),
+        runtime.isTurnInFlight
+      ),
+  };
+}
+
 export function createDesktopRuntime({ getLocalSessionBridge }) {
+  let sessionStore = null;
   return {
     async attachSessionClient(options = {}) {
       const bridge = getLocalSessionBridge();
@@ -17,7 +41,14 @@ export function createDesktopRuntime({ getLocalSessionBridge }) {
     },
     loadProjects: () => import('../runtime/shared/projects.mjs'),
     loadWorktrees: () => import('../runtime/shared/worktrees/manager.mjs'),
-    loadSessionStore: () => import('../runtime/agent/orchestrator/session/store-summary-reader.mjs'),
+    loadSessionStore() {
+      // A failed import is forgotten so the next caller retries.
+      sessionStore ??= loadSessionStoreWithRuntimeActivity().catch((error) => {
+        sessionStore = null;
+        throw error;
+      });
+      return sessionStore;
+    },
     loadSessionSearch: () => import('../runtime/session-search/session-search-db.mjs'),
     loadStatuslineSegments: () => import('../runtime/shared/statusline/statusline-segments.mjs'),
     loadConfig: () => import('../runtime/shared/config.mjs'),

package/src/standalone/daemon-local-session-bridge.mjs

@@ -22,9 +22,22 @@ export function createLocalSessionBridge({ getSessionService, log, pid = process
       return createSessionProtocolClient({
         call(name, args = {}, options = {}) {
           if (closed) throw new Error('daemon-local session client is closed');
-          return getSessionService().handleCall(name, args, {
+          const signal = options?.signal;
+          signal?.throwIfAborted();
+          const result = getSessionService().handleCall(name, args, {
             clientToken,
             ...(options?.callId ? { callId: String(options.callId) } : {}),
+            ...(signal ? { signal } : {}),
+          });
+          if (!signal) return result;
+          // The in-process service has no cancellation of its own: an abort
+          // frees the caller, whose late reply is dropped.
+          return new Promise((resolve, reject) => {
+            const onAbort = () => reject(signal.reason);
+            signal.addEventListener('abort', onAbort, { once: true });
+            Promise.resolve(result)
+              .then(resolve, reject)
+              .finally(() => signal.removeEventListener('abort', onAbort));
           });
         },
         async close(reason = 'local session view closed') {

package/src/standalone/daemon-owner.mjs

@@ -246,6 +246,7 @@ export function daemonOwnerIsStale(
  * - No successful refresh for `fenceMs`: fenced, never renewed (`onFenced`).
  * - The record names another pid: `onSuperseded(record)`.
  * - A turn gap over `stallMs`: `admit()` refuses work until a refresh succeeds.
+ *   The gap is logged once, with `describeStall(fromMono, toMono)` appended.
  * Both callbacks must make this process stop serving.
  */
 export function createOwnerHeartbeat({
@@ -259,6 +260,7 @@ export function createOwnerHeartbeat({
   monoNow = () => performance.now(),
   refresh = refreshSingletonOwner,
   log = () => {},
+  describeStall = null,
   onBeat = () => {},
   onSuperseded,
   onFenced,
@@ -290,11 +292,22 @@ export function createOwnerHeartbeat({
   }
 
   function noteTurn(t) {
-    if (t - lastTurnAt > stallMs && !needsVerify) {
-      needsVerify = true;
-      log(`event loop stalled ${Math.round(t - lastTurnAt)}ms — owner lease must be re-verified before serving`);
-    }
+    const from = lastTurnAt;
+    // Rebased before reporting: one long block is one gap, however many
+    // callers (tick, admit) observe it afterwards.
     lastTurnAt = t;
+    if (t - from <= stallMs) return;
+    needsVerify = true;
+    let detail = '';
+    try {
+      detail = describeStall?.(from, t) || '';
+    } catch {
+      /* attribution must not disturb the lease */
+    }
+    log(
+      `event loop stalled ${Math.round(t - from)}ms — owner lease must be re-verified before serving` +
+        (detail ? ` | ${detail}` : '')
+    );
   }
 
   function beat() {

package/src/standalone/daemon-pg-stop.mjs

@@ -0,0 +1,49 @@
+// The daemon's PostgreSQL stop inside its shutdown. The normal teardown stops
+// PostgreSQL after every user of it has closed, letting durable writes still in
+// flight commit first; a fallback timer stops it regardless just before the
+// launcher's kill (PG_FORCED_STOP_AT_MS), because a daemon killed before
+// `pg_ctl stop` leaves the daemonized postmaster running.
+import { PG_FORCED_STOP_AT_MS } from './daemon-stop-budget.mjs';
+
+const ADAPTER = '../runtime/memory/lib/pg/adapter.mjs';
+
+/**
+ * Arm at shutdown start. `finish()` is the ordered teardown step: it drains
+ * durable writes until the fallback point, then stops. Idempotent: whichever
+ * of finish/fallback comes first runs the one stop; the other joins it.
+ */
+export function createDaemonPgStop({
+  log,
+  stopTimeoutMs,
+  forcedStopAtMs = PG_FORCED_STOP_AT_MS,
+  loadAdapter = () => import(ADAPTER),
+}) {
+  const startedAt = Date.now();
+  let stopping = null;
+  // The drain budget is what remains until the fallback point once the adapter
+  // has loaded, so a slow load never stretches the drain past that point.
+  const drainBudget = () => Math.max(0, startedAt + forcedStopAtMs - Date.now());
+  const run = (drain) => {
+    stopping ??= loadAdapter()
+      .then(({ shutdownOwnedPg }) => shutdownOwnedPg({ timeoutMs: stopTimeoutMs, drainMs: drain ? drainBudget() : 0 }))
+      .then(
+        (stopped) => {
+          if (stopped) log('postgres stopped');
+        },
+        (e) => log(`postgres stop failed: ${e?.message || e}`)
+      );
+    return stopping;
+  };
+  const fallback = setTimeout(() => {
+    if (stopping) return; // the ordered stop is draining; its bound is this same point
+    log(`teardown still running ${forcedStopAtMs}ms into shutdown; stopping postgres before the launcher's kill`);
+    void run(false);
+  }, forcedStopAtMs);
+  fallback.unref?.();
+  return {
+    finish() {
+      clearTimeout(fallback);
+      return run(true);
+    },
+  };
+}

package/src/standalone/daemon-session-control.mjs

@@ -0,0 +1,88 @@
+import { SESSION_ID_PATTERN } from '../runtime/agent/orchestrator/runtime-core/session-id.mjs';
+import { sessionListOutput, sessionReadOutput, SESSION_TOOL_OUTPUT_BYTES } from './session-tool-output.mjs';
+
+const TARGET_ACTIONS = new Set(['status', 'read', 'send', 'cancel', 'delete']);
+const MUTATING_ACTIONS = new Set(['send', 'cancel', 'delete']);
+
+/** Model-facing session operations over the same service used by desktop and TUI. */
+export function createSessionControl({ getSessionService }) {
+  return async function executeSessionControl(args = {}, context = {}) {
+    const action = args.action;
+    if (action !== 'list' && !TARGET_ACTIONS.has(action)) {
+      throw new Error(`session: unsupported remote action "${action}"`);
+    }
+    const caller = context.callerSessionId;
+    if (typeof caller !== 'string' || !SESSION_ID_PATTERN.test(caller)) {
+      throw new Error('session: caller session is required');
+    }
+    const sessionId = typeof args.session_id === 'string' ? args.session_id.trim() : '';
+    if (TARGET_ACTIONS.has(action) && (typeof sessionId !== 'string' || !SESSION_ID_PATTERN.test(sessionId))) {
+      throw new Error(`session: session_id is required for action=${action}`);
+    }
+    if (MUTATING_ACTIONS.has(action) && sessionId === caller) {
+      throw new Error(`session: ${action} must target another session`);
+    }
+    const limit = args.limit ?? 25;
+    if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
+      throw new Error('session: limit must be an integer from 1 to 100');
+    }
+    const offset = args.offset ?? 0;
+    const textOffset = args.text_offset ?? 0;
+    if (!Number.isSafeInteger(offset) || offset < 0 || !Number.isSafeInteger(offset + limit)) {
+      throw new Error('session: offset must be a nonnegative safe integer');
+    }
+    if (!Number.isSafeInteger(textOffset) || textOffset < 0) throw new Error('session: invalid text_offset');
+    if (args.text_offset !== undefined && (args.offset === undefined || limit !== 1 || !args.item_id)) {
+      throw new Error('session: text_offset requires offset, limit:1 and item_id from read');
+    }
+    const service = getSessionService();
+    if (!service) throw new Error('session: session service is unavailable');
+    if (action === 'list') {
+      const page = await service.listSessionCatalog({ page: { limit, cursor: args.cursor || null } });
+      return sessionListOutput(page, limit);
+    }
+    if (action === 'send') {
+      if (typeof args.prompt !== 'string' || !args.prompt.trim()) {
+        throw new Error('session: prompt is required for action=send');
+      }
+      const result = await service.submitSession({
+        sessionId,
+        prompt: args.prompt,
+        options: { mode: 'prompt', transcriptMeta: { sender: 'lead' } },
+      });
+      return { sessionId, accepted: result.accepted === true };
+    }
+    if (action === 'cancel') {
+      const result = await service.abortSession({ sessionId });
+      return { sessionId, aborted: result.aborted === true };
+    }
+    if (action === 'delete') {
+      const result = await service.configureSession(
+        { sessionId, action: 'deleteSession', args: [sessionId] },
+        { revision: 1 }
+      );
+      return { sessionId, deleted: result.value === true };
+    }
+    if (action === 'read') {
+      const result = await service.readSession({ sessionId, transcriptRange: { offset, limit } });
+      return sessionReadOutput(sessionId, result.range, { textOffset, itemId: args.item_id });
+    }
+    const result = await service.readSession({
+      sessionId,
+      transcriptItemLimit: action === 'status' ? 1 : limit,
+      transcriptByteBudget: SESSION_TOOL_OUTPUT_BYTES,
+    });
+    const snapshot = result.full;
+    if (!snapshot) throw new Error(`session: ${sessionId} is unavailable`);
+    const status = {
+      sessionId,
+      title: snapshot.title ?? null,
+      cwd: snapshot.cwd ?? null,
+      provider: snapshot.provider ?? null,
+      model: snapshot.model ?? null,
+      busy: snapshot.busy === true,
+      quotaResume: snapshot.quotaResume ?? null,
+    };
+    return status;
+  };
+}

package/src/standalone/daemon-stop-budget.d.mts

@@ -0,0 +1,2 @@
+export const IN_TREE_DAEMON_STOP_GRACE_MS: number;
+export const PG_FORCED_STOP_AT_MS: number;

package/src/standalone/daemon-stop-budget.mjs

@@ -0,0 +1,18 @@
+// Time budget of an in-tree daemon's stop, shared by the launcher that waits
+// for it (desktop quit) and the daemon that has to finish inside it.
+
+/** How long a launcher waits for an in-tree daemon to exit after asking it to
+ *  stop. Past this the launcher exits and the daemon dies with its process
+ *  tree — on Windows without any exit hook. A healthy daemon stop (PostgreSQL
+ *  included) measures ~0.6 s; the rest is room for a slow teardown to finish
+ *  its writes. The desktop window is hidden before this wait begins. */
+export const IN_TREE_DAEMON_STOP_GRACE_MS = 5_000;
+
+/** `pg_ctl stop` spawn + signal delivery. Once signalled, the postmaster
+ *  finishes its shutdown on its own even if the daemon is then killed. */
+const PG_STOP_SIGNAL_MARGIN_MS = 800;
+
+/** Fallback point (from shutdown start) at which the daemon stops PostgreSQL
+ *  even while earlier teardown steps still run: just before the launcher's
+ *  kill, so a slow-but-healthy teardown keeps its writes until then. */
+export const PG_FORCED_STOP_AT_MS = IN_TREE_DAEMON_STOP_GRACE_MS - PG_STOP_SIGNAL_MARGIN_MS;

package/src/standalone/daemon-stored-session-views.mjs

@@ -11,6 +11,23 @@ import {
   readStoredGoalSnapshot,
 } from '../runtime/agent/orchestrator/runtime-core/goal-runtime.mjs';
 
+/** Catalog rows with the daemon's in-memory turn activity overlaid: `working`
+ *  on a session whose own turn is in flight, `agentWorking` on a Lead with an
+ *  in-flight Agent session. Every session runs in this process, so the runtime
+ *  state is the whole answer — storage carries no liveness. */
+async function withRuntimeActivity(rows) {
+  // The import-free leaf holding the runtime map: no session manager graph.
+  const { inFlightSessionActivity } = await import('../runtime/agent/orchestrator/session/manager/runtime-state.mjs');
+  const { working, agentWorking } = inFlightSessionActivity();
+  if (!working.size) return rows;
+  return rows.map((row) => {
+    const own = working.has(row?.id);
+    const agents = agentWorking.has(row?.id);
+    if (!own && !agents) return row;
+    return { ...row, ...(own ? { working: true } : {}), ...(agents ? { agentWorking: true } : {}) };
+  });
+}
+
 export function createStoredSessionViews({ desktopRuntime, dataDir }) {
   return {
     // Settled identity of the files a stored projection is built from; the
@@ -38,6 +55,8 @@ export function createStoredSessionViews({ desktopRuntime, dataDir }) {
       const review = createRuntimeReviewApi({ getCwd: () => metadata.cwd || '', getSessionId: () => sessionId });
       // The runtime review API answers `known`/`summary` itself (turnReviewReply).
       if (action === 'getSessionReviewDiff') return review.getSessionReviewDiff();
+      if (action === 'getSessionReviewFilePatch') return review.getSessionReviewFilePatch(args[0], args[1]);
+      if (action === 'getTurnReviewFilePatch') return review.getTurnReviewFilePatch(args[0]);
       // A cold session runs no turn: its change record is final.
       if (action === 'getTurnChanges') return review.getTurnChanges(args[0]);
       return review.getTurnReviewDiff(args[0]);
@@ -84,11 +103,14 @@ export function createStoredSessionViews({ desktopRuntime, dataDir }) {
       // ignored, full array). An authoritative refresh is never paged.
       const page = options.page && typeof options.page === 'object' ? options.page : null;
       if (page && !refreshFromStorage && store.listStoredSessionSummaryPage) {
-        return store.listStoredSessionSummaryPage({ limit: page.limit, cursor: page.cursor });
+        const listed = await store.listStoredSessionSummaryPage({ limit: page.limit, cursor: page.cursor });
+        return { ...listed, sessions: await withRuntimeActivity(listed.sessions) };
       }
       // The async listing may answer from the session catalog DB.
-      if (store.listStoredSessionSummariesAsync) return store.listStoredSessionSummariesAsync({ refreshFromStorage });
-      return store.listStoredSessionSummaries({ refreshFromStorage });
+      const rows = store.listStoredSessionSummariesAsync
+        ? await store.listStoredSessionSummariesAsync({ refreshFromStorage })
+        : store.listStoredSessionSummaries({ refreshFromStorage });
+      return withRuntimeActivity(rows);
     },
   };
 }

package/src/standalone/daemon-telemetry.mjs

@@ -139,6 +139,25 @@ export function createPostGcHeapTracker({
   };
 }
 
+/**
+ * Builds the `describeStall(fromMono, toMono)` the owner heartbeat appends to
+ * its stall line: the spans that overlapped the stall window plus the in-flight
+ * work snapshot at report time. Counters and labels only.
+ */
+export function createStallDescriber({ spans, getWork = () => ({}), limit = 3 } = {}) {
+  return (fromMono, toMono) => {
+    const parts = [];
+    const overlapping = spans?.describe(fromMono, toMono, limit);
+    if (overlapping) parts.push(overlapping);
+    const work = workCounts(getWork());
+    parts.push(
+      `in-flight: activeCalls=${work.activeCalls} queuedCalls=${work.queuedCalls}` +
+        ` busySessions=${work.busySessions} busyMemoryAgents=${work.busyMemoryAgents}`
+    );
+    return parts.join(' | ');
+  };
+}
+
 export function formatDaemonTelemetry(record, reason = 'periodic') {
   const row = record && typeof record === 'object' ? record : collectDaemonTelemetry();
   return [

package/src/standalone/daemon.mjs

@@ -66,6 +66,7 @@ import {
 import { createAgentDispatchBroker } from './agent-dispatch-broker.mjs';
 import { createChannelTransport } from './channel-transport.mjs';
 import { drainDeferral, idleGcEligible } from './daemon-drain-policy.mjs';
+import { createDaemonPgStop } from './daemon-pg-stop.mjs';
 import { createChannelSessionRouter } from '../session-runtime/services/channel-session-router.mjs';
 import { createSessionTransport } from './session-transport.mjs';
 import { createSessionService } from './session-service.mjs';
@@ -75,6 +76,7 @@ import * as quotaResumeStore from '../runtime/shared/quota-resume-store.mjs';
 import { registerWorktreeCacheCleanups } from '../runtime/shared/worktrees/cache-cleanups.mjs';
 import { createInlineSessionRuntimeHost } from './session-runtime-inline-host.mjs';
 import { getStandaloneMemoryRuntime } from '../session-runtime/services/memory-runtime-proxy.mjs';
+import { registerTranscriptPurgeHook } from '../session-runtime/session-transcript-purge.mjs';
 import { createBootPhaseProfiler } from './boot-phase-profiler.mjs';
 import { createDaemonBootCoordinator } from './daemon-boot-coordinator.mjs';
 import { createDaemonLog } from './daemon-log.mjs';
@@ -83,11 +85,14 @@ import {
   installDaemonExitRecorder,
   reconcileLostDaemonCaptures,
 } from '../session-runtime/services/daemon-crash-capture/daemon-exit-record.mjs';
-import { createDaemonTelemetry } from './daemon-telemetry.mjs';
+import { createDaemonTelemetry, createStallDescriber } from './daemon-telemetry.mjs';
+import { slowSpans } from '../runtime/shared/slow-span.mjs';
 import { createLagProfiler } from './daemon-lag-profiler.mjs';
 import { createChannelsRuntimeLoader } from './daemon-channels-loader.mjs';
 import { createDesktopRuntime } from './daemon-desktop-runtime.mjs';
 import { createCanonicalAgentControl } from './daemon-agent-control.mjs';
+import { createSessionControl } from './daemon-session-control.mjs';
+import { flushAllIndexWrites } from '../session-runtime/services/agent-tool/index-write-queue.mjs';
 import { registerAutomationAgentTool } from '../session-runtime/automation-agents.mjs';
 import {
   compareRuntimeVersions,
@@ -132,7 +137,9 @@ let sessionTransport = null;
 let sessionService = null;
 let sessionRuntimeHost = null;
 let localSessionBridge = null;
+let canonicalAgentControl = null;
 let memoryRuntime = null;
+let transcriptPurgeUnregister = null;
 let agentDispatchBroker = null;
 let remoteSessionState = { enabled: false, sessionId: null };
 let shuttingDown = false;
@@ -161,6 +168,13 @@ function registerMemoryRuntimeLazy() {
   // real memory call (memory/recall tools, the Memory install) starts the
   // singleton; nothing warms it at boot. The PG cluster itself usually starts
   // earlier: the channels schedules/webhooks stores open it at boot.
+  // Deleting a session removes its transcript file here, and its memory ingest
+  // offsets once the memory runtime exists (none when memory is skipped).
+  if (!transcriptPurgeUnregister) {
+    transcriptPurgeUnregister = registerTranscriptPurgeHook({
+      forgetOffsets: (transcriptPaths) => memoryRuntime?.forgetTranscripts(transcriptPaths),
+    });
+  }
   if (process.env.MIXDOG_DAEMON_SKIP_MEMORY === '1') {
     log('memory runtime skipped (MIXDOG_DAEMON_SKIP_MEMORY=1)');
     return;
@@ -201,6 +215,8 @@ function eventLoopStatus() {
 /** Ceiling for the whole teardown sequence, above the slowest individual stop
  *  (channels/memory) so a healthy shutdown always finishes on its own. */
 const SHUTDOWN_BUDGET_MS = 15_000;
+/** Graceful PostgreSQL stop bound inside that budget (pg_ctl stop -m fast). */
+const PG_STOP_TIMEOUT_MS = 6_000;
 
 async function shutdown(reason, code = 0) {
   if (shuttingDown) return;
@@ -221,6 +237,9 @@ async function shutdown(reason, code = 0) {
     process.exit(code);
   }, SHUTDOWN_BUDGET_MS);
   forcedExit.unref?.();
+  // PostgreSQL stops after its users below (durable writes drained first), or
+  // at the fallback point just before the launcher's kill, whichever is first.
+  const pgStop = createDaemonPgStop({ log, stopTimeoutMs: PG_STOP_TIMEOUT_MS });
   try {
     setChannelNotifySink(null);
   } catch {}
@@ -241,6 +260,15 @@ async function shutdown(reason, code = 0) {
   } catch (e) {
     log(`session runtime host stop failed: ${e?.message || e}`);
   }
+  // Every runtime is closed: drain the canonical agent's index writers (and any
+  // other queued index write) before process.exit, whose 'exit' hook cannot
+  // finish async work.
+  try {
+    await canonicalAgentControl?.dispose?.();
+    await flushAllIndexWrites();
+  } catch (e) {
+    log(`agent index drain failed: ${e?.message || e}`);
+  }
   // Host-side Computer Use workers and target claims are reaped only on an
   // explicit release; the runtime's deferred timer is unref'd and never fires
   // once this process exits.
@@ -271,6 +299,11 @@ async function shutdown(reason, code = 0) {
   } catch (e) {
     log(`memory.stop failed: ${e?.message || e}`);
   }
+  // PostgreSQL this daemon started through its stores (schedules, webhooks,
+  // session search) after every user of it above is closed. `pg_ctl start`
+  // daemonizes the postmaster outside this process tree, so without this stop
+  // it outlives the daemon. A cluster another live process owns is left to it.
+  await pgStop.finish();
   try {
     agentDispatchBroker?.close?.(reason);
   } catch (e) {
@@ -315,6 +348,9 @@ function inFlightWork() {
 
 // Opt-in CPU profiling of lag windows while DATA_DIR/lag-profile.on exists.
 const lagProfiler = createLagProfiler({ dataDir: DATA_DIR, log });
+// Request spans share the heartbeat's performance.now() clock; `[slow-op]` lines
+// and stall attribution come from the same recorder.
+slowSpans.setLog(log);
 
 daemonTelemetry = createDaemonTelemetry({
   log,
@@ -506,6 +542,7 @@ async function claimDaemonOwnership(bootPhases) {
     tickMs: timings.tickMs,
     stallMs: timings.stallMs,
     log,
+    describeStall: createStallDescriber({ spans: slowSpans, getWork: inFlightWork }),
     onBeat: republishMissingDiscovery,
     onSuperseded: (record) => fenceDaemon(`owner claim superseded by pid=${record?.pid}`),
     onFenced: ({ lastRefreshAt, sinceMs }) =>
@@ -696,6 +733,22 @@ function announceDaemonReady({ port, token, startedAt, bootPhases }) {
   });
 }
 
+/** After ready, off every request path: arm the last-chance PostgreSQL stop on
+ *  exit, then open the schedules/webhooks stores. On an existing cluster that
+ *  starts PostgreSQL here, so the first catalog read (the desktop sidebar's
+ *  channel setup) joins this start instead of being the one that runs it; a
+ *  data dir with no cluster yet starts nothing (channel-admin). Loaded after
+ *  the stderr redirect, so the PG layer's logs reach daemon.log. */
+function startPostgresInBackground() {
+  void import('../runtime/memory/lib/pg/adapter.mjs')
+    .then((pg) => {
+      pg.installOwnedPgExitStop();
+      if (shuttingDown) return null;
+      return import('../session-runtime/services/channel-admin.mjs').then((admin) => admin.hasActiveAutomation());
+    })
+    .catch((error) => log(`postgres background start failed: ${error?.message || error}`));
+}
+
 /** The channels front door: pointer-routed calls over HTTP+SSE. Creating the
  *  transport also wires the channels notification sink (session-bound
  *  notifications reach the session service, the rest fan out to channel
@@ -844,6 +897,7 @@ async function main() {
     getSessionRuntimeHost: () => sessionRuntimeHost,
     cwd: CWD,
   });
+  canonicalAgentControl = agentControl;
   // Schedules and webhooks run headless here; their sessions reach the same
   // canonical agent control through the automation tool scope.
   registerAutomationAgentTool(agentControl.execute);
@@ -860,6 +914,7 @@ async function main() {
     log,
     measureBootPhase: bootPhases.measure,
     executeAgentControl: agentControl.execute,
+    executeSessionControl: createSessionControl({ getSessionService: () => sessionService }),
   });
   // Codex-style runtime: daemon routing and independent async session actors
   // share one V8 isolate and module graph. CPU-heavy work stays in bounded
@@ -938,6 +993,13 @@ async function main() {
   log(`session front door on 127.0.0.1:${sessionEndpoint.port}`);
 
   announceDaemonReady({ port, token, startedAt, bootPhases });
+  // After ready, off the boot path: load the session-runtime module tree so
+  // the first session.create does not block the loop on synchronous module
+  // compilation. Failures fall back to the lazy import inside create.
+  setImmediate(() => {
+    void sessionRuntimeHost?.warmLocalRuntime?.();
+  });
+  startPostgresInBackground();
 
   // Automation may spawn the shared daemon; keep schedules/webhooks live.
   // A TUI-spawned daemon keeps the historical eager start (its channels client

package/src/standalone/desktop-service-registry.mjs

@@ -1,6 +1,7 @@
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 import { sanitizeForWire } from './session-wire-values.mjs';
+import { annotateSpan } from '../runtime/shared/slow-span.mjs';
 import { modelProxyClientMode } from '../runtime/shared/model-proxy-mode.mjs';
 import { getModelProxyChannel } from '../runtime/agent/orchestrator/providers/model-proxy-channel.mjs';
 
@@ -217,6 +218,10 @@ export class DesktopServiceRegistry {
     const { service } = this.#requireSubscribed(desktopId, ctx);
     const name = String(method || '');
     if (!name) throw new TypeError('desktop service method is required');
+    // `[slow-op] desktop.invoke` names the call it timed: a desktop operation
+    // (Git reads) or a session capability, not only the generic route.
+    const target = name === 'invokeDesktopOperation' || name === 'invokeCapability' ? String(args?.[0] || '') : '';
+    annotateSpan(target ? `${name}:${target}` : name);
     return sanitizeForWire(await service.instance.invoke(name, Array.isArray(args) ? args : [])) ?? null;
   }