mixdog 1.2.4 → 1.2.6

package/src/session-runtime/services/usage-dashboard.mjs

@@ -2,11 +2,6 @@ import {
   fetchOAuthUsageSnapshot,
   readCachedOAuthUsageSnapshot,
 } from '../../runtime/agent/orchestrator/providers/oauth-usage.mjs';
-import {
-  fetchOpenCodeGoUsageSnapshot,
-  openCodeGoUsageConfigStatus,
-  readCachedOpenCodeGoUsageSnapshot,
-} from '../../runtime/agent/orchestrator/providers/opencode-go-usage.mjs';
 import {
   fetchApiUsageSnapshot,
   readCachedApiUsageSnapshot,
@@ -118,69 +113,32 @@ async function apiProviderRow(item, { config, providers, preview, refreshFor, sn
   if (row.authenticated) {
     let hasQuota = false;
     let apiUsageSnapshot = null;
-    if (item.id === 'opencode-go') {
-      const usageStatus = openCodeGoUsageConfigStatus(config);
-      try {
-        let snapshot = null;
-        if (refreshFor(item.id)) snapshot = await fetchOpenCodeGoUsageSnapshot(config, { force: true });
-        else snapshot = readCachedOpenCodeGoUsageSnapshot();
-        if (!snapshot && !refreshFor(item.id) && usageStatus.ready) {
-          snapshot = await fetchOpenCodeGoUsageSnapshot(config);
-        }
-        if (snapshot) {
-          hasQuota = applyWindowQuota(row, snapshot?.quotaWindows, {
-            source: 'opencode-go-console',
-            detail: 'subscription quota',
-          });
-          row.updatedAt = num(snapshot?.cachedAt, null);
-        } else {
-          row.status = 'missing';
-          row.source = 'usage-auth-missing';
-          row.sourceLabel = 'usage auth';
-          row.primary = '';
-          row.detail = usageStatus.ready
-            ? 'OpenCode Go usage not found'
-            : 'Set an OpenCode console API key (all permissions) for usage';
-        }
-      } catch (err) {
-        if (String(err?.code || '').startsWith('OPENCODE_GO_USAGE_')) {
-          row.status = 'missing';
-          row.source = 'usage-auth-missing';
-          row.sourceLabel = 'usage auth';
-          row.primary = '';
-          row.detail = usageStatus.ready
-            ? 'OpenCode Go usage not found'
-            : 'Set an OpenCode console API key (all permissions) for usage';
-        }
-      }
-    } else {
-      const snapshot = await apiSnapshot(item.id, snapshotOptions(item.id));
-      apiUsageSnapshot = snapshot;
-      const known = snapshotRemaining(snapshot);
-      const usage = snapshotUsage(snapshot);
-      const tokenUsage = snapshotTokenUsage(snapshot);
-      const windows = normaliseWindows(snapshot?.quotaWindows, clean(snapshot?.source) || 'provider-api');
-      const estimated = localBudget(providerCfg);
-      row.updatedAt = num(snapshot?.cachedAt, null);
-      if (known) {
-        applyKnownRemaining(row, known, { estimated: false });
-        row.sourceLabel = 'API';
-        hasQuota = true;
-      } else if (windows.length) {
-        hasQuota = applyWindowQuota(row, windows, {
-          source: clean(snapshot?.source) || 'provider-api',
-          detail: 'provider quota',
-        });
-      } else if (estimated) {
-        applyKnownRemaining(row, estimated, { estimated: true });
-        hasQuota = true;
-      } else if (usage) {
-        applyKnownUsage(row, usage);
-        hasQuota = true;
-      } else if (tokenUsage) {
-        applyTokenUsage(row, tokenUsage);
-        hasQuota = true;
-      }
+    const snapshot = await apiSnapshot(item.id, snapshotOptions(item.id));
+    apiUsageSnapshot = snapshot;
+    const known = snapshotRemaining(snapshot);
+    const usage = snapshotUsage(snapshot);
+    const tokenUsage = snapshotTokenUsage(snapshot);
+    const windows = normaliseWindows(snapshot?.quotaWindows, clean(snapshot?.source) || 'provider-api');
+    const estimated = localBudget(providerCfg);
+    row.updatedAt = num(snapshot?.cachedAt, null);
+    if (known) {
+      applyKnownRemaining(row, known, { estimated: false });
+      row.sourceLabel = 'API';
+      hasQuota = true;
+    } else if (windows.length) {
+      hasQuota = applyWindowQuota(row, windows, {
+        source: clean(snapshot?.source) || 'provider-api',
+        detail: 'provider quota',
+      });
+    } else if (estimated) {
+      applyKnownRemaining(row, estimated, { estimated: true });
+      hasQuota = true;
+    } else if (usage) {
+      applyKnownUsage(row, usage);
+      hasQuota = true;
+    } else if (tokenUsage) {
+      applyTokenUsage(row, tokenUsage);
+      hasQuota = true;
     }
     if (!row.includeInTotal && !hasQuota) {
       const estimated = localBudget(providerCfg);
@@ -189,7 +147,7 @@ async function apiProviderRow(item, { config, providers, preview, refreshFor, sn
         hasQuota = true;
       }
     }
-    if (item.id !== 'opencode-go' && !row.includeInTotal && !hasQuota) {
+    if (!row.includeInTotal && !hasQuota) {
       applyApiUnavailable(row, item.id, apiUsageSnapshot);
     }
   }

package/src/session-runtime/turn/session-ops.mjs

@@ -105,9 +105,9 @@ export function createSessionOps(deps) {
     return mode;
   }
 
-  function interruptTaskWait(reason = 'user-message') {
+  function interruptTaskWait(reason = 'user-message', detail = null) {
     const sessionId = getSession()?.id || getReservedSessionId?.() || '';
-    return interruptTaskWaitForSession(sessionId, reason);
+    return interruptTaskWaitForSession(sessionId, reason, detail);
   }
 
   // Raw model-message read for LIVE transcript consumers (remote agent

package/src/session-runtime/turn/turn-run/ask-callbacks.mjs

@@ -86,6 +86,7 @@ export function createAskCallbacks({ transcript, notifyFnForSession, scheduleSea
       },
       onUsageDelta: options.onUsageDelta,
       onAssistantToolCallObserved: options.onAssistantToolCallObserved,
+      onStreamItemStart: options.onStreamItemStart,
       onToolResult: (message) => options.onToolResult?.(message),
       onToolApproval: options.onToolApproval,
       onCompactEvent: options.onCompactEvent,

package/src/session-runtime/usage-stats-api.mjs

@@ -237,7 +237,8 @@ export function createUsageStatsApi({
     /**
      * This runtime's session from its first request, compactions included; null before it has one.
      * `sessionIds` adds the same totals for each named session (the agents it spawned) under
-     * `sessions`, each read by its own id only.
+     * `sessions`, each read by its own id only. `agents: true` adds `agents`: one total of every
+     * session ever run for this one (closed and replaced agents included) and the named sessions.
      */
     async getSessionUsage(options = {}) {
       const sessionId = getSessionId();
@@ -249,6 +250,10 @@ export function createUsageStatsApi({
       const usage = await store.sessionUsageAsync(sessionUsageIdsFor(scopes, sessionId));
       const result = { sessionId, ...sessionUsageSnapshot(usage) };
       const others = otherSessionIds(options, sessionId);
+      if (options?.agents === true) {
+        const named = others.flatMap((id) => sessionUsageIdsFor(scopes, id));
+        result.agents = sessionUsageSnapshot(await store.sessionUsageAsync(named, [sessionId]));
+      }
       if (!others.length) return result;
       const totals = await Promise.all(
         others.map(async (id) => [

package/src/standalone/channel-transport/http-routes.mjs

@@ -31,9 +31,10 @@ export function createChannelRoutes({
   // Checked on every register/call/agent dispatch, first and again right
   // before the work is handed on (the lease may have been fenced while the
   // body was still arriving): a daemon that lost (or cannot re-verify) its
-  // owner lease serves nothing.
-  function refuseUnadmitted(res) {
-    if (admitWork()) return false;
+  // owner lease serves nothing. `admitWork` may answer asynchronously (a
+  // request arriving during the lease's re-verification waits for it).
+  async function refuseUnadmitted(res) {
+    if (await admitWork()) return false;
     sendError(res, 'daemon owner lease is not held', 503);
     return true;
   }
@@ -54,10 +55,10 @@ export function createChannelRoutes({
   }
 
   async function register(req, res) {
-    if (refuseUnadmitted(res)) return;
+    if (await refuseUnadmitted(res)) return;
     if (state.drainCommitted) return sendDraining(res);
     const body = await readChannelBody(req);
-    if (refuseUnadmitted(res)) return;
+    if (await refuseUnadmitted(res)) return;
     const clientToken = registry.registerClient({
       leadPid: body.leadPid,
       cwd: body.cwd,
@@ -96,11 +97,11 @@ export function createChannelRoutes({
   // channels client registry alive. The broker itself owns a parallel fair
   // scheduler and per-call cancellation.
   async function agentDispatch(req, res) {
-    if (refuseUnadmitted(res)) return;
+    if (await refuseUnadmitted(res)) return;
     if (state.drainCommitted) return sendDraining(res);
     if (!agentBroker?.dispatch) return sendError(res, 'agent broker unavailable', 503);
     const body = await readChannelBody(req);
-    if (refuseUnadmitted(res)) return;
+    if (await refuseUnadmitted(res)) return;
     const callId = String(body.callId || '').trim();
     if (!callId) return sendError(res, 'callId required', 400);
     res.on('close', () => {
@@ -130,10 +131,10 @@ export function createChannelRoutes({
   }
 
   async function call(req, res) {
-    if (refuseUnadmitted(res)) return;
+    if (await refuseUnadmitted(res)) return;
     if (state.drainCommitted) return sendDraining(res);
     const body = await readChannelBody(req);
-    if (refuseUnadmitted(res)) return;
+    if (await refuseUnadmitted(res)) return;
     const clientToken = body.token || null;
     const c = clientToken ? clients.get(clientToken) : null;
     if (!c) return sendError(res, 'unknown client token', 404);

package/src/standalone/daemon-desktop-runtime.mjs

@@ -12,22 +12,33 @@
  *  this daemon's in-memory turn activity (every session runs inline here, so
  *  it is the single source of truth; worker index files only declare work). */
 async function loadSessionStoreWithRuntimeActivity() {
-  const [store, runtime, progress] = await Promise.all([
+  const [store, runtime, progress, tasks] = await Promise.all([
     import('../runtime/agent/orchestrator/session/store-summary-reader.mjs'),
     // The import-free leaf holding the runtime map: no session manager graph.
     import('../runtime/agent/orchestrator/session/manager/runtime-state.mjs'),
     import('../runtime/agent/orchestrator/session/agent-pool-progress.mjs'),
+    import('../runtime/shared/background-tasks.mjs'),
   ]);
   return {
     ...store,
     // Running rows also carry their turn's progress stamp and stage (the
-    // quiet-time cue), read from the same runtime map.
-    listStoredAgentWorkers: () =>
-      progress.withTurnProgress(
-        store.listStoredAgentWorkers({ runningSessionIds: runtime.inFlightSessionActivity().working }),
+    // quiet-time cue), read from the same runtime map; an idle row whose
+    // agent handed off background shell work that still runs reads waiting.
+    // The handed-off shell work of every row comes from one task scan. The
+    // store is read with awaited I/O (a listing runs on every activity
+    // change); the running set is taken once those reads are done.
+    listStoredAgentWorkers: async () => {
+      const rows = await store.listStoredAgentWorkersAsync({
+        runningSessionIds: () => runtime.inFlightSessionActivity().working,
+      });
+      const awaiting = tasks.activeBackgroundTaskSessionIds({ surface: 'shell', awaitedOnly: true });
+      return progress.withTurnProgress(
+        rows,
         (sessionId) => runtime.runtimeState.get(sessionId),
-        runtime.isTurnInFlight
-      ),
+        runtime.isTurnInFlight,
+        (sessionId) => awaiting.has(sessionId)
+      );
+    },
   };
 }
 
@@ -53,6 +64,8 @@ export function createDesktopRuntime({ getLocalSessionBridge }) {
     loadStatuslineSegments: () => import('../runtime/shared/statusline/statusline-segments.mjs'),
     loadConfig: () => import('../runtime/shared/config.mjs'),
     loadDocumentPreview: () => import('../runtime/office/pdf/document-preview.mjs'),
+    // The desktop service's git children start on this worker, off the loop.
+    loadProcessRunner: () => import('../runtime/shared/process-runner.mjs'),
     async executeCodeGraphTool(name, args, cwd) {
       const graph = await import('../runtime/agent/orchestrator/tools/code-graph/dispatch.mjs');
       return graph.executeCodeGraphTool(name, args, cwd);

package/src/standalone/daemon-owner.mjs

@@ -15,6 +15,14 @@
 //   being renewed, and every register/call asks `admit()` first. After an
 //   event-loop stall nothing is served until a refresh under the claim lock
 //   proves the record still names it — a contender's claim takes that lock.
+//   A lease that ran out DURING such a stall (live when the loop stopped) is
+//   the one exception to the fence: the holder never had a turn to refresh
+//   or to fence, and a contender's reclaim is decided under the claim lock
+//   against the record's heartbeat there (daemonOwnerIsStale re-checks it),
+//   so a refresh that finds the record still naming this pid proves no
+//   contender took it and none can on its earlier proof. Without that, a sole
+//   daemon whose loop the machine starved past the lease killed itself and
+//   every running turn with no other daemon to take over.
 // - Holder's record names `livenessPort` from its very first claim: a tiny
 //   loopback listener started BEFORE the claim (startOwnerLivenessListener)
 //   answers /health with the pid, through boot and for the process lifetime.
@@ -32,8 +40,9 @@
 // daemon.json publishes, answering with that pid, proves them alive.
 import http from 'node:http';
 import { readFileSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
 import { isPidAlive } from '../runtime/shared/pid-liveness.mjs';
-import { readSingletonOwner, refreshSingletonOwner } from '../runtime/shared/singleton-owner.mjs';
+import { readSingletonOwner, refreshSingletonOwnerAsync } from '../runtime/shared/singleton-owner.mjs';
 
 export const DAEMON_OWNER_STALE_MS = 60_000;
 export const OWNER_PROBE_TIMEOUT_MS = 3_000;
@@ -58,11 +67,23 @@ export function daemonOwnerTimings(env = process.env) {
 }
 
 /** daemon.json's pid and session endpoint, or null when missing/unreadable. */
+function discoveryOf(parsed) {
+  const session = parsed?.endpoints?.session;
+  return { pid: Number(parsed?.pid) || 0, port: Number(session?.port) || 0, token: session?.token || '' };
+}
+
 export function readDiscovery(discoveryPath) {
   try {
-    const parsed = JSON.parse(readFileSync(discoveryPath, 'utf8'));
-    const session = parsed?.endpoints?.session;
-    return { pid: Number(parsed?.pid) || 0, port: Number(session?.port) || 0, token: session?.token || '' };
+    return discoveryOf(JSON.parse(readFileSync(discoveryPath, 'utf8')));
+  } catch {
+    return null;
+  }
+}
+
+/** readDiscovery without blocking the event loop. */
+export async function readDiscoveryAsync(discoveryPath) {
+  try {
+    return discoveryOf(JSON.parse(await readFile(discoveryPath, 'utf8')));
   } catch {
     return null;
   }
@@ -243,7 +264,10 @@ export function daemonOwnerIsStale(
  * `tickMs` it checks the lease, notices stalls, and every `heartbeatMs`
  * rewrites `owner` with a fresh wall-clock `heartbeatAt` under the claim lock
  * (recreating a deleted record), then calls `onBeat`.
- * - No successful refresh for `fenceMs`: fenced, never renewed (`onFenced`).
+ * - No successful refresh for `fenceMs`: fenced, never renewed (`onFenced`) —
+ *   unless the lease ran out inside one stall (live when the loop stopped):
+ *   then the refresh is retried every tick for `heartbeatMs` after the loop
+ *   resumes, and fenced only if none succeeds by then.
  * - The record names another pid: `onSuperseded(record)`.
  * - A turn gap over `stallMs`: `admit()` refuses work until a refresh succeeds.
  *   The gap is logged once, with `describeStall(fromMono, toMono)` appended.
@@ -258,7 +282,7 @@ export function createOwnerHeartbeat({
   stallMs,
   now = Date.now,
   monoNow = () => performance.now(),
-  refresh = refreshSingletonOwner,
+  refresh = refreshSingletonOwnerAsync,
   log = () => {},
   describeStall = null,
   onBeat = () => {},
@@ -272,6 +296,13 @@ export function createOwnerHeartbeat({
   let lastBeatAt = leaseFrom;
   let lastTurnAt = leaseFrom;
   let needsVerify = false;
+  // Monotonic time the loop resumed from a stall that outlived the lease.
+  let stallResumedAt = null;
+  // The refresh in flight: a promise of its settled status, else null.
+  let pending = null;
+  // When the latest stall was noticed: only a refresh started after it can
+  // re-verify the record (an older one may have read it before the stall).
+  let stallNotedAt = Number.NEGATIVE_INFINITY;
   let timer = null;
 
   function halt(next) {
@@ -284,6 +315,12 @@ export function createOwnerHeartbeat({
     return t - leaseFrom >= fenceMs;
   }
 
+  // Expired and past re-verification: the refreshes failed while the loop
+  // ran, or no refresh landed within `heartbeatMs` of resuming from a stall.
+  function mustFence(t) {
+    return leaseExpired(t) && !(stallResumedAt !== null && t - stallResumedAt < heartbeatMs);
+  }
+
   function fence(t) {
     if (state !== 'active') return;
     halt('fenced');
@@ -298,6 +335,8 @@ export function createOwnerHeartbeat({
     lastTurnAt = t;
     if (t - from <= stallMs) return;
     needsVerify = true;
+    stallNotedAt = t;
+    if (state === 'active' && !leaseExpired(from) && leaseExpired(t)) stallResumedAt = t;
     let detail = '';
     try {
       detail = describeStall?.(from, t) || '';
@@ -310,13 +349,53 @@ export function createOwnerHeartbeat({
     );
   }
 
+  // A refresh's verdict, applied once it is known. Fenced, superseded or
+  // stopped while it ran: nothing is renewed. A renewal counts from the
+  // moment the refresh started (`t`), never from when it answered.
+  function settle(t, heartbeatAt, result) {
+    if (state !== 'active') return result.status;
+    if (result.status === 'refreshed') {
+      if (leaseExpired(t)) {
+        log(
+          `owner lease re-verified ${Math.round(t - leaseFrom)}ms after its last refresh (event-loop stall)` +
+            ' — the record still names this process; serving again'
+        );
+      }
+      leaseFrom = t;
+      lastRefreshAt = heartbeatAt;
+      if (t >= stallNotedAt) {
+        needsVerify = false;
+        stallResumedAt = null;
+      }
+      onBeat();
+    } else if (result.status === 'superseded') {
+      halt('superseded');
+      onSuperseded(result.owner);
+    } else if (result.status === 'busy') {
+      log('owner heartbeat skipped: claim lock busy');
+    }
+    return result.status;
+  }
+
+  function failedRefresh(error) {
+    log(`owner heartbeat failed: ${error?.message || error}`);
+    return { status: 'failed' };
+  }
+
+  // One refresh at a time. An asynchronous refresh (the default: its file
+  // work and lock retries never block the loop) answers 'pending' here and
+  // settles later; the lease and fence keep their monotonic deadlines while
+  // it runs — a refresh still unanswered at the fence does not hold it off.
   function beat() {
     if (state !== 'active') return null;
+    if (pending) return 'pending';
     const t = monoNow();
     lastBeatAt = t;
-    // Checked before every renewal: an overdue beat after a stall must fence,
-    // not extend a lease a contender may already have reclaimed.
-    if (leaseExpired(t)) {
+    // Checked before every renewal: an overdue beat must fence, not extend a
+    // lease a contender may already have reclaimed — except right after a
+    // stall that outlived the lease, where the refresh itself (under the
+    // claim lock) answers whether one did.
+    if (mustFence(t)) {
       fence(t);
       return 'fenced';
     }
@@ -325,28 +404,26 @@ export function createOwnerHeartbeat({
     try {
       result = refresh(ownerPath, { ...record, heartbeatAt });
     } catch (error) {
-      log(`owner heartbeat failed: ${error?.message || error}`);
-      result = { status: 'failed' };
-    }
-    if (result.status === 'refreshed') {
-      leaseFrom = t;
-      lastRefreshAt = heartbeatAt;
-      needsVerify = false;
-      onBeat();
-    } else if (result.status === 'superseded') {
-      halt('superseded');
-      onSuperseded(result.owner);
-    } else if (result.status === 'busy') {
-      log('owner heartbeat skipped: claim lock busy');
+      result = failedRefresh(error);
     }
-    return result.status;
+    if (typeof result?.then !== 'function') return settle(t, heartbeatAt, result);
+    pending = result
+      .then(
+        (value) => value,
+        (error) => failedRefresh(error)
+      )
+      .then((value) => {
+        pending = null;
+        return settle(t, heartbeatAt, value);
+      });
+    return 'pending';
   }
 
   function tick() {
     if (state !== 'active') return;
     const t = monoNow();
     noteTurn(t);
-    if (leaseExpired(t)) fence(t);
+    if (mustFence(t)) fence(t);
     else if (needsVerify ? t - lastBeatAt >= tickMs : t - lastBeatAt >= heartbeatMs) beat();
   }
 
@@ -363,7 +440,7 @@ export function createOwnerHeartbeat({
       // Shutting down: no ticks run to measure stalls; the lease still bounds it.
       if (state === 'stopped') return !leaseExpired(t);
       noteTurn(t);
-      if (leaseExpired(t)) {
+      if (mustFence(t)) {
         fence(t);
         return false;
       }
@@ -372,8 +449,23 @@ export function createOwnerHeartbeat({
       if (needsVerify && t - lastBeatAt >= tickMs) beat();
       return state === 'active' && !needsVerify;
     },
+    /** admit(), but a request arriving while the lease is being re-verified
+     *  waits for the verifying refresh instead of being refused outright: at
+     *  most two refreshes (one started before the stall cannot verify). */
+    async admitAsync() {
+      for (let attempt = 0; attempt < 2; attempt += 1) {
+        if (this.admit()) return true;
+        if (!pending) return false;
+        await pending;
+      }
+      return this.admit();
+    },
     beat,
     tick,
+    /** Settles with the in-flight refresh's status (null when none runs). */
+    settled() {
+      return pending ?? Promise.resolve(null);
+    },
     /** Stop beating (shutdown). admit() keeps refusing once the lease runs out. */
     stop() {
       if (state === 'active') halt('stopped');

package/src/standalone/daemon.mjs

@@ -35,7 +35,8 @@ import path from 'node:path';
 import { rmSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { monitorEventLoopDelay, performance } from 'node:perf_hooks';
-import { writeJsonAtomicSync } from '../runtime/shared/atomic-file.mjs';
+import { writeJsonAtomicAsync } from '../runtime/shared/atomic-file.mjs';
+import { prewarmOwnerOnlyAclWin32 } from '../runtime/shared/file-permissions.mjs';
 import { ensurePrivateRuntimeRoot, resolveRuntimeRoot } from '../runtime/shared/runtime-root.mjs';
 import { ensureProcessListenerHeadroom } from '../runtime/shared/process-listener-headroom.mjs';
 import { listenerLeakWarningLine } from '../runtime/shared/listener-leak-warning.mjs';
@@ -46,6 +47,7 @@ import {
   daemonOwnerTimings,
   discoveryPid,
   proveDaemonOwnerRecord,
+  readDiscoveryAsync,
   startOwnerLivenessListener,
 } from './daemon-owner.mjs';
 import { remoteIntentPath } from '../runtime/shared/remote-intent.mjs';
@@ -607,11 +609,12 @@ function daemonStatusSnapshot() {
 }
 
 /** The file every attacher reads to find this daemon: wire identity plus both
- *  loopback endpoints and their privileged tokens. */
+ *  loopback endpoints and their privileged tokens. Written asynchronously
+ *  (the secret file's owner-only ACL included), never on the event loop. */
 function publishDaemonDiscovery({ channel, session, modelProxy = null }) {
   // A re-publish keeps the first publication's startedAt.
   publishedEndpoints = { channel, session, modelProxy, startedAt: publishedEndpoints?.startedAt ?? Date.now() };
-  writeJsonAtomicSync(
+  return writeJsonAtomicAsync(
     DAEMON_DISCOVERY_PATH,
     {
       protocol: SESSION_PROTOCOL,
@@ -658,6 +661,13 @@ function admitOwnerWork() {
   return ownerHeartbeat ? ownerHeartbeat.admit() : true;
 }
 
+/** admitOwnerWork for the HTTP front doors: a request that arrives while the
+ *  lease is being re-verified (the refresh is asynchronous) waits for that
+ *  refresh instead of being refused. */
+function admitOwnerWorkAsync() {
+  return ownerHeartbeat ? ownerHeartbeat.admitAsync() : true;
+}
+
 /** This process no longer holds (or is about to lose) the owner lease: refuse
  *  new work at once, unpublish its endpoint so launchers stop finding it, then
  *  shut down within the shutdown budget — before a contender may reclaim. */
@@ -678,14 +688,31 @@ function fenceDaemon(reason) {
 /** Heartbeat follow-up while this process still owns the lock: a daemon.json
  *  deleted (TEMP cleanup) or overwritten while it runs is written again, so
  *  new clients keep finding the one daemon that serves this data dir. */
+// Read and rewritten asynchronously, one check at a time: this runs after
+// every heartbeat, and its synchronous read of daemon.json was measured
+// blocking the loop for 5.9 s under disk contention.
+let republishing = false;
 function republishMissingDiscovery() {
-  if (!publishedEndpoints || shuttingDown || discoveryPid(DAEMON_DISCOVERY_PATH) === process.pid) return;
-  try {
-    publishDaemonDiscovery(publishedEndpoints);
-    log('daemon.json was missing or named another pid — re-published');
-  } catch (error) {
-    log(`daemon.json re-publish failed: ${error?.message || error}`);
-  }
+  if (!publishedEndpoints || shuttingDown || republishing) return;
+  republishing = true;
+  void (async () => {
+    try {
+      if ((await readDiscoveryAsync(DAEMON_DISCOVERY_PATH))?.pid === process.pid || shuttingDown) return;
+      await publishDaemonDiscovery(publishedEndpoints);
+      // Fenced while it was written: take it back down (fenceDaemon already ran).
+      if (shuttingDown) {
+        if ((await readDiscoveryAsync(DAEMON_DISCOVERY_PATH))?.pid === process.pid) {
+          rmSync(DAEMON_DISCOVERY_PATH, { force: true });
+        }
+        return;
+      }
+      log('daemon.json was missing or named another pid — re-published');
+    } catch (error) {
+      log(`daemon.json re-publish failed: ${error?.message || error}`);
+    } finally {
+      republishing = false;
+    }
+  })();
 }
 
 /** Ready handshake for the spawner, plus the log-sink handoff pinned to the
@@ -757,7 +784,7 @@ async function startChannelFrontDoor({ channelsRuntime, bootPhases }) {
   transport = createChannelTransport({
     handleCall: channelsRuntime.handleCall,
     agentBroker: agentDispatchBroker,
-    admitWork: admitOwnerWork,
+    admitWork: admitOwnerWorkAsync,
     log,
     // The durable channel link lives in this file. Without it a restart loses
     // the pinned session (nothing to restore) and every catalog reports Remote
@@ -974,7 +1001,7 @@ async function main() {
       } catch {}
     },
     onUpgradeRequested: requestDaemonReplacement,
-    admitWork: admitOwnerWork,
+    admitWork: admitOwnerWorkAsync,
   });
   const sessionEndpoint = await bootPhases.measure('session-transport-start', () => sessionTransport.start());
   const modelProxyEndpoint = await startModelProxyBridge(bootPhases);
@@ -988,7 +1015,7 @@ async function main() {
     exitRecorder.setReason(`owner claim superseded by pid=${ownerPid} before publish`, 0);
     process.exit(0);
   }
-  publishDaemonDiscovery({ channel: { port, token }, session: sessionEndpoint, modelProxy: modelProxyEndpoint });
+  await publishDaemonDiscovery({ channel: { port, token }, session: sessionEndpoint, modelProxy: modelProxyEndpoint });
   bootPhases.mark('discovery-published');
   log(`session front door on 127.0.0.1:${sessionEndpoint.port}`);
 
@@ -1000,6 +1027,9 @@ async function main() {
     void sessionRuntimeHost?.warmLocalRuntime?.();
   });
   startPostgresInBackground();
+  // Secret writes (token stores, config) find the ACL helpers already running
+  // instead of starting one under their file lock.
+  void prewarmOwnerOnlyAclWin32();
 
   // Automation may spawn the shared daemon; keep schedules/webhooks live.
   // A TUI-spawned daemon keeps the historical eager start (its channels client