mixdog 1.2.3 → 1.2.5

package/src/session-runtime/model-route/set-route.mjs

@@ -1,6 +1,8 @@
 /**
- * set-route.mjs — select the main route: resolve and validate the request,
- * adopt it into config, then decide how the current session follows it
+ * set-route.mjs — select the runtime's route: resolve and validate the
+ * request, adopt it as the live route (its per-model settings saved; the main
+ * model only on an explicit main-model choice, keepMainModel: false), then
+ * decide when the current session follows it
  * (untouched, tuned, recreated, updated in place when empty, or switched in
  * place when the selection is addressed to an established conversation).
  */
@@ -21,6 +23,7 @@ import {
   shouldRecreateEmptySessionForRouteChange,
 } from '../../runtime/agent/orchestrator/runtime-core/session-route-policy.mjs';
 import { rebuildToolSurfaceForProviderWithMigration } from '../../runtime/agent/orchestrator/session/loop/tool-exposure-migration.mjs';
+import { UNOWNED_LEASE, openRouteLease } from './route-ownership.mjs';
 
 /** The request, completed from the live route where the caller left gaps. */
 function completeRequest(deps, next) {
@@ -80,20 +83,26 @@ async function resolveSelectedRoute(deps, next) {
 }
 
 /** Close the empty session and materialize a fresh one for the new provider. */
-async function recreateEmptySession(deps) {
+async function recreateEmptySession(deps, lease) {
   const { getSession, setSession, mgr, statusRoutes, createCurrentSession, invalidatePreSessionToolSurface } = deps;
   // If the boot create is still finishing SessionStart/deferred-surface
   // work, drain that promise first. Otherwise createCurrentSession()
   // would return the old in-flight promise after we tombstone/null the
   // session, racing the intended rebuild for the new provider.
   await createCurrentSession('model-switch-empty-drain');
-  const emptySession = getSession();
-  if (!emptySession?.id || sessionHasRouteHistory(emptySession)) return;
-  statusRoutes?.clearGatewaySessionRoute?.(emptySession.id);
-  mgr.closeSession?.(emptySession.id, 'cli-model-switch-empty', { tombstone: true });
-  setSession(null);
-  invalidatePreSessionToolSurface?.();
-  await createCurrentSession('model-switch-empty');
+  const closed = lease.run(
+    () => {
+      const emptySession = getSession();
+      if (!emptySession?.id || sessionHasRouteHistory(emptySession)) return false;
+      statusRoutes?.clearGatewaySessionRoute?.(emptySession.id);
+      mgr.closeSession?.(emptySession.id, 'cli-model-switch-empty', { tombstone: true });
+      setSession(null);
+      invalidatePreSessionToolSurface?.();
+      return true;
+    },
+    () => false
+  );
+  if (closed) await createCurrentSession('model-switch-empty');
 }
 
 /** Rewrite the addressed empty session to the route it was asked to run on. */
@@ -164,7 +173,7 @@ function switchSessionInPlace(deps, session) {
 }
 
 /** Validate, persist and adopt the requested route as the runtime's route. */
-async function adoptRoute(deps, persist, next, options) {
+async function adoptRoute(deps, persist, next, options, lease) {
   const {
     getConfig,
     getRoute,
@@ -175,15 +184,40 @@ async function adoptRoute(deps, persist, next, options) {
     scheduleStatuslineUsageRefresh,
   } = deps;
   const { selectedRoute, fastCapable, modelMeta } = await resolveSelectedRoute(deps, next);
-  persist.saveRouteModelSettings(selectedRoute, fastCapable);
-  // An heir opening on its source's model is not a main-model choice.
-  const leadRoute = persist.persistAdoptedModelSettings(selectedRoute, {
-    keepMainModel: options?.keepMainModel === true,
-  });
-  setRouteState(resolveRoute(getConfig(), leadRoute ? { model: workflowPresetId('lead') } : selectedRoute));
-  await refreshRouteEffort(modelMeta);
-  refreshStatuslineUsageSnapshot(getRoute());
-  scheduleStatuslineUsageRefresh();
+  // Provider readiness may outlast the session the selection was made for.
+  const adopted = lease.run(
+    () => {
+      if (options?.sessionOnly === true) {
+        // An agent child's route belongs to that session alone: the shared
+        // modelSettings bucket (saved effort/Fast per model) and the main
+        // model (lead preset / default model) are never written.
+        setRouteState(resolveRoute(getConfig(), selectedRoute));
+      } else {
+        persist.saveRouteModelSettings(selectedRoute, fastCapable);
+        // The main model changes only on an explicit main-model choice
+        // (keepMainModel: false, e.g. the setup tool); every other selection
+        // — the session surface's model pick, an heir — keeps it.
+        const leadRoute = persist.persistAdoptedModelSettings(selectedRoute, {
+          keepMainModel: options?.keepMainModel !== false,
+        });
+        setRouteState(resolveRoute(getConfig(), leadRoute ? { model: workflowPresetId('lead') } : selectedRoute));
+      }
+      return true;
+    },
+    () => false
+  );
+  if (!adopted) return false;
+  // The refresh completes against the route just adopted and only while the
+  // selection still owns it.
+  await refreshRouteEffort(modelMeta, getRoute(), null, lease);
+  return lease.run(
+    () => {
+      refreshStatuslineUsageSnapshot(getRoute());
+      scheduleStatuslineUsageRefresh();
+      return true;
+    },
+    () => false
+  );
 }
 
 /**
@@ -194,17 +228,25 @@ async function adoptRoute(deps, persist, next, options) {
  * `{ modelSwitch }` with the recorded boundary (as setRoute does) so the
  * session surface shows the same live divider, or true when nothing switched.
  */
-export function createContinueSessionInModel(deps, persist) {
-  const { getSession, invalidateContextStatusCache } = deps;
+export function createContinueSessionInModel(deps, persist, clearPendingRoute) {
+  const { getSession, getSessionGeneration, invalidateContextStatusCache } = deps;
   return async function continueSessionInModel(sessionId, next) {
     const session = getSession();
     if (!sessionId || !session?.id || session.id !== sessionId) {
       throw new Error(`session ${sessionId || ''} is not the active session`);
     }
-    await adoptRoute(deps, persist, next, {});
-    const modelSwitch = switchSessionInPlace(deps, session);
-    invalidateContextStatusCache();
-    return modelSwitch ? { modelSwitch } : true;
+    const lease = openRouteLease(getSessionGeneration);
+    const adopted = await adoptRoute(deps, persist, next, {}, lease);
+    return lease.run(
+      () => {
+        if (!adopted) return true;
+        const modelSwitch = switchSessionInPlace(deps, session);
+        invalidateContextStatusCache();
+        clearPendingRoute?.();
+        return modelSwitch ? { modelSwitch } : true;
+      },
+      () => true
+    );
   };
 }
 
@@ -215,9 +257,10 @@ async function validateSelectedRoute(deps, next) {
 }
 
 export function createSetRoute(deps, persist) {
-  const { getRoute, getSession, invalidateContextStatusCache, createCurrentSession } = deps;
+  const { getRoute, getSession, getSessionGeneration, invalidateContextStatusCache, createCurrentSession } = deps;
+  let pending = null;
 
-  return async function setRoute(next, options = {}) {
+  async function setRoute(next, options = {}) {
     // Without an explicit durable address a selection is for a new/inherited
     // session and never rewrites an existing conversation's model, unless it
     // is the user's model choice for this conversation (`switchEstablished`,
@@ -225,11 +268,28 @@ export function createSetRoute(deps, persist) {
     // place while an empty one follows the unaddressed rules below.
     const applyToCurrentSession = options?.applyToCurrentSession === true;
     const switchEstablished = applyToCurrentSession || options?.switchEstablished === true;
-    // Lets a caller prove the selection is acceptable before it does
-    // irreversible work (compaction) ahead of the switch; changes nothing.
+    // Validate without persisting the selection or changing the session.
     if (options?.validateOnly === true) return validateSelectedRoute(deps, next);
-    await adoptRoute(deps, persist, next, options);
+    // A selection addressed to a conversation belongs to the session
+    // generation it was enqueued under (the surface's enqueue boundary names
+    // it; a direct call is enqueued now). Once that generation has moved, every
+    // route or session effect is skipped by the lease and the current route
+    // stands.
+    const addressed = switchEstablished || options?.deferUntilNextTurn === true;
+    const lease = addressed ? openRouteLease(getSessionGeneration, options?.originGeneration) : UNOWNED_LEASE;
+    const adopted = await adoptRoute(deps, persist, next, options, lease);
+    if (!adopted) return getRoute();
+    return lease.run(() => followSession(options, lease, { switchEstablished, applyToCurrentSession }), getRoute);
+  }
+
+  /** What the adopted route does to the session it was selected for. */
+  async function followSession(options, lease, { switchEstablished, applyToCurrentSession }) {
     const session = getSession();
+    if (options.deferUntilNextTurn === true) {
+      pending = session?.id ? { generation: lease.token } : null;
+      return getRoute();
+    }
+    pending = null;
     // A session the user has already talked in or compacted keeps its route
     // unless the selection was addressed to it. A current session with no
     // model reply, no compaction summary and no in-flight first turn — empty,
@@ -240,8 +300,8 @@ export function createSetRoute(deps, persist) {
       if (!switchEstablished) return getRoute();
       const route = getRoute();
       // An addressed selection of another model switches the conversation
-      // itself in place; the caller (session surface) refuses it while a
-      // turn runs. A same-model update (effort/Fast) only tunes the session
+      // itself in place; the session surface defers it to the next turn
+      // instead. A same-model update (effort/Fast) only tunes the session
       // from its next turn.
       if (session && (route.provider !== session.provider || route.model !== session.model)) {
         const modelSwitch = switchSessionInPlace(deps, session);
@@ -259,7 +319,9 @@ export function createSetRoute(deps, persist) {
       session?.id &&
       typeof createCurrentSession === 'function'
     ) {
-      await recreateEmptySession(deps);
+      // The recreation installs a new session itself, so nothing after it
+      // acts for the selection beyond dropping the stale gauge.
+      await recreateEmptySession(deps, lease);
       invalidateContextStatusCache();
       return getRoute();
     }
@@ -272,5 +334,23 @@ export function createSetRoute(deps, persist) {
       invalidateContextStatusCache();
     }
     return getRoute();
+  }
+  setRoute.applyPendingRoute = () => {
+    if (!pending) return null;
+    const selection = pending;
+    if (selection.generation !== getSessionGeneration()) {
+      pending = null;
+      return null;
+    }
+    // The live route is the latest selection: effort/Fast tuned after the
+    // deferred model choice replace it, so no snapshot is kept.
+    const modelSwitch = switchSessionInPlace(deps, getSession());
+    invalidateContextStatusCache();
+    pending = null;
+    return modelSwitch;
+  };
+  setRoute.clearPendingRoute = () => {
+    pending = null;
   };
+  return setRoute;
 }

package/src/session-runtime/model-route/web-search-route.mjs

@@ -6,6 +6,7 @@ import { clean, hasOwn } from '../../runtime/agent/orchestrator/runtime-core/ses
 import { coerceEffortFor } from '../../runtime/agent/orchestrator/runtime-core/effort.mjs';
 import { ensureProviderEnabled } from '../../runtime/agent/orchestrator/runtime-core/config-helpers.mjs';
 import { selectionFastCapable } from '../route-state.mjs';
+import { routeChain } from '../../runtime/shared/model-route-chain.mjs';
 import {
   isDefaultWebSearchRouteConfig,
   isWebSearchCapableProvider,
@@ -93,9 +94,13 @@ export function createWebSearchRouteApi(deps) {
       if (isDefaultWebSearchRouteConfig(selectedRoute)) {
         await awaitKeychainPrewarm();
         ensureFullConfig();
-        return saveWebSearchRoute(defaultWebSearchRoute(selectedRoute.toolType));
       }
-      return saveWebSearchRoute(await resolveExplicitRoute(selectedRoute));
+      const resolved = [];
+      for (const entry of routeChain(selectedRoute)) {
+        resolved.push(isDefaultWebSearchRouteConfig(entry) ? entry : await resolveExplicitRoute(entry));
+      }
+      const [primary, ...fallbacks] = resolved;
+      return saveWebSearchRoute(normalizeWebSearchRouteConfig({ ...primary, fallbacks }));
     },
   };
 }

package/src/session-runtime/model-route-api.mjs

@@ -19,10 +19,12 @@ export { shouldRecreateEmptySessionForRouteChange } from '../runtime/agent/orche
 
 export function createModelRouteApi(deps) {
   const persist = createRoutePersistence(deps);
+  const setRoute = createSetRoute(deps, persist);
   return {
     ...createWebSearchRouteApi(deps),
-    setRoute: createSetRoute(deps, persist),
-    continueSessionInModel: createContinueSessionInModel(deps, persist),
+    setRoute,
+    applyPendingRoute: setRoute.applyPendingRoute,
+    continueSessionInModel: createContinueSessionInModel(deps, persist, setRoute.clearPendingRoute),
     ...createRouteTuning(deps, persist),
   };
 }

package/src/session-runtime/native-web-search/routes.mjs

@@ -4,6 +4,7 @@
  * follow-Main default.
  */
 import { webSearchRouteOrDefault } from '../../runtime/agent/orchestrator/runtime-core/workflow.mjs';
+import { routeChain, canonicalRouteProvider } from '../../runtime/shared/model-route-chain.mjs';
 
 export function createWebSearchRouteCandidates({
   getRoute,
@@ -50,35 +51,47 @@ export function createWebSearchRouteCandidates({
     // before the Main Model was ever consulted.
     const webSearchRoute = webSearchRouteOrDefault(cfg.webSearchRoute, getWebSearchRoute());
     setWebSearchRoute(webSearchRoute);
+    const candidates = [];
+    const seen = new Set();
+    for (const selected of routeChain(webSearchRoute)) {
+      const candidate = await resolveCandidate(selected, cfg, route);
+      if (!candidate) continue;
+      const provider = canonicalRouteProvider(candidate.provider);
+      if (seen.has(provider)) continue;
+      seen.add(provider);
+      candidates.push({ ...candidate, provider });
+    }
+    return candidates;
+  }
+
+  async function resolveCandidate(webSearchRoute, cfg, route) {
     if (isDefaultWebSearchRouteConfig(webSearchRoute)) {
       const loadedRow = route?.provider && route?.model ? await loadMainCatalogRow(cfg, route) : null;
       const mainModel = currentMainWebSearchModelMeta(loadedRow);
-      if (!mainModel || !webSearchCapableFor(route.provider, mainModel)) return [];
-      return [
-        {
-          key: `default\n${route.provider}\n${route.model}`,
-          provider: normalizeWebSearchProviderId(route.provider),
-          model: route.model,
-          source: 'default-web-search-route',
-          effort: route.effectiveEffort || route.effort || null,
-          fast: route.fast === true,
-          toolType: webSearchRoute.toolType || null,
-        },
-      ];
+      if (!mainModel || !webSearchCapableFor(route.provider, mainModel)) return null;
+      return {
+        key: `default\n${route.provider}\n${route.model}`,
+        provider: normalizeWebSearchProviderId(route.provider),
+        model: route.model,
+        source: 'default-web-search-route',
+        effort: route.effectiveEffort || route.effort || null,
+        fast: route.fast === true,
+        modelParameters: route.modelParameters || {},
+        toolType: webSearchRoute.toolType || null,
+      };
     }
     const providerName = normalizeWebSearchProviderId(webSearchRoute.provider);
-    if (!isWebSearchCapableProvider(providerName)) return [];
-    return [
-      {
-        key: `${providerName}\n${webSearchRoute.model}`,
-        provider: providerName,
-        model: webSearchRoute.model,
-        source: 'web-search-route',
-        effort: webSearchRoute.effort || null,
-        fast: webSearchRoute.fast === true,
-        toolType: webSearchRoute.toolType || null,
-      },
-    ];
+    if (!isWebSearchCapableProvider(providerName)) return null;
+    return {
+      key: `${providerName}\n${webSearchRoute.model}`,
+      provider: providerName,
+      model: webSearchRoute.model,
+      source: 'web-search-route',
+      effort: webSearchRoute.effort || null,
+      fast: webSearchRoute.fast === true,
+      modelParameters: webSearchRoute.modelParameters || {},
+      toolType: webSearchRoute.toolType || null,
+    };
   }
 
   return { currentMainWebSearchModelMeta, nativeWebSearchRoutes };

package/src/session-runtime/native-web-search.mjs

@@ -14,6 +14,7 @@ import {
 } from './native-web-search/tool-shape.mjs';
 import { createWebSearchRouteCandidates } from './native-web-search/routes.mjs';
 import { reportNativeWebSearchUsage } from './native-web-search-usage.mjs';
+import { canFallbackRoute } from '../runtime/shared/model-route-fallback.mjs';
 
 export function createNativeWebSearch(deps) {
   const {
@@ -98,14 +99,14 @@ export function createNativeWebSearch(deps) {
     if (!candidates.length) throw noCandidateError();
     const errors = [];
     for (const candidate of candidates) {
-      for (const toolType of toolTypesFor(candidate)) {
-        try {
-          return await sendCandidate(candidate, toolType, webSearchArgs, signal);
-        } catch (err) {
-          errors.push(
-            `${candidate.provider}${candidate.model ? `/${candidate.model}` : ''}/${toolType}: ${err?.message || String(err)}`
-          );
-        }
+      const [toolType] = toolTypesFor(candidate);
+      try {
+        return await sendCandidate(candidate, toolType, webSearchArgs, signal);
+      } catch (err) {
+        if (!canFallbackRoute(err, { signal })) throw err;
+        errors.push(
+          `${candidate.provider}${candidate.model ? `/${candidate.model}` : ''}/${toolType}: ${err?.message || String(err)}`
+        );
       }
     }
     throw new Error(`native web search failed: ${errors.join(' | ')}`);

package/src/session-runtime/provider-auth/setup.mjs

@@ -3,6 +3,7 @@
 // the model catalog.
 import { refreshKeychainStatus, retryKeychain } from '../../runtime/shared/config.mjs';
 import { keychainIssueFor } from '../services/provider-admin.mjs';
+import { modelProxyClientMode } from '../../runtime/shared/model-proxy-mode.mjs';
 
 // The keyring alert must reflect the live state (it can lock or unlock while a
 // cached setup is served), so overlay it on every ready read.
@@ -26,6 +27,9 @@ export function createSetupApi({
   return {
     async getProviderSetup(options = {}) {
       const force = options?.force === true || options?.refresh === true;
+      if (modelProxyClientMode()) {
+        return cachedProviderSetup({ force: force || options?.recheckKeychain === true });
+      }
       // An unforced read never blocks: the authoritative setup waits on the OS
       // keychain, which can take seconds on a cold start and used to stall the
       // whole settings sweep behind it. Serve

package/src/session-runtime/provider-models/catalog-load.mjs

@@ -2,6 +2,7 @@
 // One authoritative provider catalog load: secrets and providers ready, the
 // daemon-wide startup refresh joined (or a forced refresh run), then the shared
 // catalog flattened into deduplicated rows with per-provider profiling.
+import { modelProxyClientMode } from '../../runtime/shared/model-proxy-mode.mjs';
 import { isSelectableLlmModel } from '../model-recency.mjs';
 import { sharedProviderCatalog } from '../provider-catalog-cache.mjs';
 import { NO_ENABLED_PROVIDERS } from '../../runtime/agent/orchestrator/providers/registry-errors.mjs';
@@ -49,6 +50,14 @@ export function createCatalogLoader({
     }
     const providersStartedAt = performance.now();
     try {
+      if (forceRefresh && modelProxyClientMode()) {
+        const { loadModelProxyProviderConfig } = await import(
+          '../../runtime/agent/orchestrator/providers/model-proxy-provider.mjs'
+        );
+        await loadModelProxyProviderConfig({ force: true });
+        // Rebuild even when daemon readiness already settled on the old PC set.
+        await reg().initProviders({});
+      }
       await ensureProvidersReady(config().providers || {});
     } catch (error) {
       if (error?.code === NO_ENABLED_PROVIDERS) return false;

package/src/session-runtime/provider-models/web-search-catalog.mjs

@@ -4,6 +4,8 @@
 // the already-loaded provider rows over a provider round-trip.
 import { isSelectableLlmModel } from '../model-recency.mjs';
 import { catalogRevision } from '../provider-catalog-cache.mjs';
+import { modelProxyClientMode } from '../../runtime/shared/model-proxy-mode.mjs';
+import { loadModelProxyProviderConfig } from '../../runtime/agent/orchestrator/providers/model-proxy-provider.mjs';
 
 export function createWebSearchCatalog({
   caches,
@@ -14,15 +16,22 @@ export function createWebSearchCatalog({
   quickHelpers,
   normalizeWebSearchProviderId,
   isWebSearchCapableProvider,
+  collectProviderModels,
   ensureFullConfig,
   awaitKeychainPrewarm,
   ensureProvidersReady,
 }) {
   async function enabledWebSearchProviderConfig() {
-    await awaitKeychainPrewarm();
-    ensureFullConfig();
+    let providers;
+    if (modelProxyClientMode()) {
+      providers = await loadModelProxyProviderConfig();
+    } else {
+      await awaitKeychainPrewarm();
+      ensureFullConfig();
+      providers = config().providers;
+    }
     const out = {};
-    for (const [name, providerConfig] of Object.entries(config().providers || {})) {
+    for (const [name, providerConfig] of Object.entries(providers || {})) {
       const providerName = normalizeWebSearchProviderId(name);
       if (!providerConfig?.enabled || !isWebSearchCapableProvider(providerName)) continue;
       out[providerName] = { ...providerConfig, enabled: true };
@@ -66,6 +75,12 @@ export function createWebSearchCatalog({
   }
 
   async function loadWebSearchProviderModelsFresh({ forceRefresh = false } = {}) {
+    if (modelProxyClientMode()) {
+      // Share the desktop-backed catalog's readiness, force refresh and retry
+      // semantics. Server-local quick rows cannot describe desktop accounts.
+      const models = await collectProviderModels({ force: forceRefresh });
+      return quickHelpers.webSearchRowsWithDefault(quickHelpers.webSearchModelsFromRows(models));
+    }
     const webSearchProviders = await enabledWebSearchProviderConfig();
     const providerNames = Object.keys(webSearchProviders);
     if (!providerNames.length) return [];
@@ -89,6 +104,11 @@ export function createWebSearchCatalog({
   }
 
   async function collectWebSearchProviderModels({ force = false } = {}) {
+    if (modelProxyClientMode()) {
+      // The main catalog owns caching in client mode, including incomplete
+      // loads; do not pin an empty/offline projection in a second cache.
+      return rows.providerModelsFromCacheRows(await loadWebSearchProviderModelsFresh({ forceRefresh: force }));
+    }
     const revision = meta.syncCatalogRevision();
     if (force) {
       const models = await loadWebSearchProviderModelsFresh({ forceRefresh: true });

package/src/session-runtime/provider-models.mjs

@@ -63,6 +63,7 @@ export function createProviderModels({
     quickHelpers,
     normalizeWebSearchProviderId,
     isWebSearchCapableProvider,
+    collectProviderModels,
     ...readiness,
   });
   const loadProviderModelsFresh = createCatalogLoader({ caches, config, reg, meta, rows, profile, ...readiness });

package/src/session-runtime/provider-usage.mjs

@@ -5,6 +5,7 @@
 // references) and all config/registry reads flow through supplied accessors so
 // live-binding is preserved.
 import { clean } from '../runtime/agent/orchestrator/runtime-core/session-text.mjs';
+import { modelProxyClientMode } from '../runtime/shared/model-proxy-mode.mjs';
 
 // A post-redeem dashboard rebuild is best effort: past this budget the caller
 // gets its confirmed outcome and the surface revalidates on its own cadence.
@@ -70,6 +71,9 @@ export function createProviderUsage({
   }
 
   async function cachedProviderSetup({ force = false, quick = false } = {}) {
+    // The proxy owns a short, connection-generation-aware cache. A session's
+    // indefinite local cache would hide PC sign-ins, sign-outs and reconnects.
+    if (modelProxyClientMode()) return providerSetup(displayConfig(), { force });
     if (!force && caches.providerSetupCache.setup) {
       return caches.providerSetupCache.setup;
     }

package/src/session-runtime/route-resolution.mjs

@@ -35,7 +35,7 @@ export function createRouteResolution({ rt, collectProviderModels, ensureProvide
     return rt.route;
   }
 
-  async function refreshRouteEffort(modelMetaOverride = null, expectedRoute = null, signal = null) {
+  async function refreshRouteEffort(modelMetaOverride = null, expectedRoute = null, signal = null, lease = null) {
     const targetRoute = expectedRoute || rt.route;
     await runAbortable(signal, () => ensureProvidersReady(ensureProviderEnabled(rt.config, targetRoute.provider)));
     const modelMeta =
@@ -43,7 +43,9 @@ export function createRouteResolution({ rt, collectProviderModels, ensureProvide
     throwIfAborted(signal);
     // A rapid second resume/model change can replace the route while provider
     // metadata is loading. Never let the older completion overwrite it.
+    // A selection whose session was replaced while this loaded owns nothing.
     if (expectedRoute && rt.route !== expectedRoute) return null;
+    if (lease && !lease.valid()) return null;
     const { effectiveEffort, fastCapable } = resolveRouteEffortState(targetRoute, modelMeta);
     const contextState = resolveRouteContextState(targetRoute, modelMeta);
     const contextValue = clean(targetRoute.modelParameters?.context);

package/src/session-runtime/runtime-core.mjs

@@ -18,6 +18,7 @@ function bootParams({
   model,
   effort,
   fast,
+  autoEffort,
   modelParameters,
   contextPercent,
   contextTokens,
@@ -33,12 +34,14 @@ function bootParams({
   sessionProfile = null,
   worktree = null,
   executeAgentControl = null,
+  executeSessionControl = null,
 } = {}) {
   return {
     provider,
     model,
     effort,
     fast,
+    autoEffort,
     modelParameters,
     contextPercent,
     contextTokens,
@@ -55,6 +58,7 @@ function bootParams({
     // Creation-time worktree intent (workspace/transitions.mjs creationIntent).
     worktree,
     executeAgentControl,
+    executeSessionControl,
   };
 }
 

package/src/session-runtime/runtime-facade.mjs

@@ -31,6 +31,7 @@ export function createRuntimeFacade({
   const currentSessionId = () => state.session?.id || state.reservedSessionId || state.addressedSessionId || null;
   return {
     ...leadingApi,
+    isSessionTerminal: () => state.admission === 'terminal',
     /** Bind the durable address to the conversation this runtime just
      *  loaded (resume / load-on-demand). Idempotent for the same id. */
     bindSessionAddress(sessionId) {
@@ -135,6 +136,11 @@ export function createRuntimeFacade({
     get session() {
       return state.session;
     },
+    /** Advances whenever another conversation (or none) is installed; a route
+     *  selection captures it when enqueued (see model-route/route-ownership). */
+    get sessionGeneration() {
+      return state.sessionGeneration;
+    },
     contextStatus(options) {
       return getContextStatus(options);
     },

package/src/session-runtime/services/agent-task-status.mjs

@@ -111,6 +111,7 @@ function cleanStage(value) {
 }
 
 function describeLastProgress({ stage, snapshot, runtime, silentFor, lastToolCall, now }) {
+  if (snapshot?.awaitingModelResponse) return 'model thinking (request sent; awaiting response headers)';
   if (snapshot?.waitingForTransport) return 'awaiting model transport';
   if (snapshot?.waitingForFirstSemantic) {
     return 'transport active; awaiting first model event';
@@ -169,6 +170,7 @@ function describeAgentDiagnostic({ taskStatus, sessionStatus, stage, snapshot, s
     if (abortErr) return `stale: ${abortErr.message.replace(/^agent /i, '')}`;
   }
 
+  if (snapshot?.awaitingModelResponse) return 'model thinking; request sent, response headers pending';
   if (snapshot?.waitingForTransport) return 'waiting for model transport';
   if (snapshot?.waitingForFirstSemantic) {
     return 'transport healthy; waiting for first semantic model event';

package/src/session-runtime/services/agent-tool/close-flow/close-all.mjs

@@ -10,9 +10,6 @@ export function createCloseAll({ registry, close }) {
   const { tags, tagAgents, tagCwds } = registry;
 
   function resetLocalTagState() {
-    for (const timer of registry.reapTimers.values()) clearTimeout(timer);
-    registry.reapTimers.clear();
-    registry.clearScheduledReaps();
     tags.clear();
     tagAgents.clear();
     tagCwds.clear();

package/src/session-runtime/services/agent-tool/close-flow.mjs

@@ -58,21 +58,20 @@ export function createCloseFlow({ mgr, registry, views }) {
     if (isLeadPoolAgent(registry.getLiveSession(sessionId)?.agent)) {
       throw new Error(`agent close: target "${target}" is a Lead session`);
     }
-    registry.cancelReap(sessionId);
     const descendantSessionIds =
       typeof mgr.descendantSessionIds === 'function' ? mgr.descendantSessionIds(sessionId) : [];
     const tag = registry.tagForSession(sessionId);
     clearAgentStatuslineRoute(sessionId);
     cancelSessionTasks(sessionId, target, scopedContext);
-    // Close (and stamp cancelStatus) BEFORE dropping the worker row. Removing
-    // the row first left the next pool read with only a leftover heartbeat,
-    // which republished the session as `running`. The explicit task_id cancel
+    // Close (and stamp cancelStatus) BEFORE dropping the worker row, so the
+    // row never outlives an unrecorded cancel. The explicit task_id cancel
     // below is an idempotent no-op fallback once terminal.
-    const ok = await mgr.closeSession(sessionId, 'cli-agent-close');
+    // Closing a runtime cancels its work; only explicit session deletion
+    // may tombstone the conversation.
+    const ok = await mgr.closeSession(sessionId, 'cli-agent-close', { tombstone: false });
     if (task?.taskId) cancelBackgroundTask(task.taskId, CLOSE_REASON);
     // Drop the row only once the cancellation is DURABLY recorded: a failed
-    // close that still forgot the row left a fresh heartbeat with no cancelled
-    // state — the exact lingering row this path exists to prevent.
+    // close that still forgot the row would leave no cancelled state behind.
     if (ok) {
       registry.forgetTerminalSession(tag, sessionId);
       for (const descendantSessionId of descendantSessionIds) {