mixdog 1.2.5 → 1.2.6

package/src/runtime/agent/orchestrator/session/store/lifecycle-barriers.mjs

@@ -25,7 +25,14 @@ import {
   releaseWriteCommit as _releaseWriteCommit,
 } from './write-guards.mjs';
 import { _sessionForDisk } from './serialize.mjs';
-import { _commitSessionWrite, _discardSaveTmp, _trackSaveTmp, _untrackSaveTmp } from './save-fault.mjs';
+import {
+  _commitSessionWrite,
+  _commitSessionWriteAttempt,
+  _discardSaveTmp,
+  _trackSaveTmp,
+  _untrackSaveTmp,
+} from './save-fault.mjs';
+import { sleep } from '../../../../shared/sleep.mjs';
 import {
   _droppedSaveIds,
   _clearLiveSession,
@@ -100,15 +107,25 @@ function _readLifecycleAuthority(id, reason, action, lifecycleOnly = false) {
   return authority;
 }
 
-/** Commit a barrier record, bypassing the save queue + guard. False when it did not land. */
-function _writeLifecycleRecord(id, record, existing, reason) {
+/** Commit a barrier record, bypassing the save queue + guard. False when it did not land.
+ *  `attempt` (a number) commits with ONE rename of the retry schedule: a
+ *  retryable refusal with attempts left discards the scratch file, records
+ *  nothing and returns a retry ({ retryInMs }) instead of sleeping. */
+function _writeLifecycleRecord(id, record, existing, reason, attempt = null) {
   const target = sessionPath(id);
   const tmp = _trackSaveTmp(`${target}.${randomBytes(6).toString('hex')}.tmp`);
   try {
     const disk = _sessionForDisk(record);
     writeFileSync(tmp, JSON.stringify(disk), 'utf-8');
     const scratch = _stampSessionScratch(tmp);
-    _commitSessionWrite(tmp, target, id);
+    if (attempt === null) _commitSessionWrite(tmp, target, id);
+    else {
+      const retryInMs = _commitSessionWriteAttempt(tmp, target, id, attempt);
+      if (retryInMs !== null) {
+        _discardSaveTmp(tmp);
+        return { retryInMs };
+      }
+    }
     // Read-only lifecycle checks (pending-message gates right after a close/
     // detach) reuse what this barrier wrote; write authority still re-reads.
     _readCanonicalRecord.rememberOwnBarrier(target, scratch, _lifecycleOfSessionDocument(disk));
@@ -179,6 +196,10 @@ function _recordAbsent(options) {
  * saveSession() calls.
  */
 export function markSessionClosed(id, reason = 'manual', options = {}) {
+  return _markSessionClosed(id, reason, options, null);
+}
+
+function _markSessionClosed(id, reason, options, attempt) {
   // Only a fresh failure from THIS attempt may be observed by closeSession's
   // durable-barrier check — a veto must not surface a stale error.
   clearSessionLifecycleCommitError(id);
@@ -232,7 +253,8 @@ export function markSessionClosed(id, reason = 'manual', options = {}) {
       updatedAt: closeTime,
       ..._cancelStatusFields(base, reason, options.cancelStatus, closeTime),
     };
-    if (!_writeLifecycleRecord(id, tombstone, existing, reason)) return null;
+    const wrote = _writeLifecycleRecord(id, tombstone, existing, reason, attempt);
+    if (wrote !== true) return wrote || null;
     _savePending.delete(id);
     clearSessionSaveError(id);
     _clearLiveSession(id);
@@ -262,6 +284,10 @@ export function markSessionClosed(id, reason = 'manual', options = {}) {
  * Returns the new generation, or null if the session file doesn't exist.
  */
 export function bumpSessionGeneration(id, reason = 'detach', options = {}) {
+  return _bumpSessionGeneration(id, reason, options, null);
+}
+
+function _bumpSessionGeneration(id, reason, options, attempt) {
   clearSessionLifecycleCommitError(id);
   // The detach barrier is a canonical write and MUST take the same commit
   // lock as markSessionClosed. Cancellation alone is not a barrier: a writer
@@ -289,7 +315,8 @@ export function bumpSessionGeneration(id, reason = 'detach', options = {}) {
     if (!existing) return _recordAbsent(options);
     const newGen = (typeof existing.generation === 'number' ? existing.generation : 0) + 1;
     const detached = { ...existing, generation: newGen, updatedAt: Date.now(), detachedReason: reason };
-    if (!_writeLifecycleRecord(id, detached, existing, reason)) return null;
+    const wrote = _writeLifecycleRecord(id, detached, existing, reason, attempt);
+    if (wrote !== true) return wrote || null;
     _savePending.delete(id);
     clearSessionSaveError(id);
     _clearLiveSession(id);
@@ -300,3 +327,43 @@ export function bumpSessionGeneration(id, reason = 'detach', options = {}) {
     _releaseWriteCommit(commitControl);
   }
 }
+
+// ── Non-blocking barriers ────────────────────────────────────────────────────
+// The synchronous barriers above wait out a refused rename (Windows EPERM/
+// EBUSY while a scanner holds the file) with sleepSync INSIDE the commit lock,
+// freezing the whole daemon for up to the full backoff schedule (4.6 s seen).
+// An attempt instead runs the complete barrier — authority read, cancellation,
+// record built from the current copy, ONE rename — under the commit lock and,
+// when the rename is refused with attempts left, returns a retry
+// ({ retryInMs }) having recorded nothing. The lock is released between
+// attempts; the next attempt re-reads everything, so a save that landed in
+// between is folded into the barrier instead of overwriting it. Same backoff
+// schedule and the same final error as the synchronous barrier.
+
+/** Whether a barrier attempt asked to be retried after `retryInMs`. */
+export function isLifecycleRetry(result) {
+  return typeof result?.retryInMs === 'number';
+}
+
+/** Attempt `attempt` of markSessionClosed (see isLifecycleRetry). */
+export function markSessionClosedAttempt(id, reason = 'manual', options = {}, attempt = 0) {
+  return _markSessionClosed(id, reason, options, attempt);
+}
+
+/** Attempt `attempt` of bumpSessionGeneration (see isLifecycleRetry). */
+export function bumpSessionGenerationAttempt(id, reason = 'detach', options = {}, attempt = 0) {
+  return _bumpSessionGeneration(id, reason, options, attempt);
+}
+
+async function _runBarrierAttempts(run) {
+  for (let attempt = 0; ; attempt++) {
+    const result = run(attempt);
+    if (!isLifecycleRetry(result)) return result;
+    await sleep(result.retryInMs);
+  }
+}
+
+/** markSessionClosed without ever blocking the event loop on a rename retry. */
+export function markSessionClosedAsync(id, reason = 'manual', options = {}) {
+  return _runBarrierAttempts((attempt) => _markSessionClosed(id, reason, options, attempt));
+}

package/src/runtime/agent/orchestrator/session/store/load-session.mjs

@@ -9,6 +9,7 @@ import { _savePending } from './pending-saves.mjs';
 import { _liveSessions, _droppedSaveIds, getFailedSaveSnapshot } from './live-state.mjs';
 import { _readStoredSessionCached } from './load-cache.mjs';
 import { _ensureLifecycleFields } from './serialize.mjs';
+import { isSettledSessionStamp, sameSessionStamp, statSessionStamp } from './canonical-reader.mjs';
 
 export function loadSession(id) {
   const path = sessionPath(id);
@@ -58,3 +59,42 @@ export function loadSession(id) {
   if (live?.id === id) _liveSessions.delete(id);
   return disk.session ? _ensureLifecycleFields(disk.session) : null;
 }
+
+// `status` of loadSession(id), for the agent-status pulse: it reads every
+// worker's status every two seconds, and an idle worker's whole transcript
+// (released from the load cache's small document budget) was re-read and
+// strictly re-parsed on every beat. The answer loadSession gave is reused only
+// while the file keeps the exact settled full stamp it was read under and no
+// in-memory copy (pending save, live snapshot, failed-save evidence) can speak
+// for the id instead; anything else asks loadSession again.
+const STATUS_CACHE_LIMIT = 4096;
+const _statusByPath = new Map(); // path -> { stamp, status }
+
+function _observeStamp(path) {
+  try {
+    return statSessionStamp(path);
+  } catch {
+    return null;
+  }
+}
+
+export function loadSessionStatus(id) {
+  const path = sessionPath(id);
+  const inMemory = _savePending.has(id) || _liveSessions.has(id) || getFailedSaveSnapshot(id);
+  const before = inMemory ? null : _observeStamp(path);
+  const cached = before ? _statusByPath.get(path) : null;
+  if (cached && sameSessionStamp(cached.stamp, before)) return cached.status;
+  _statusByPath.delete(path);
+  const status = loadSession(id)?.status ?? null;
+  if (
+    before &&
+    isSettledSessionStamp(before) &&
+    !_savePending.has(id) &&
+    !_liveSessions.has(id) &&
+    sameSessionStamp(before, _observeStamp(path))
+  ) {
+    if (_statusByPath.size >= STATUS_CACHE_LIMIT) _statusByPath.delete(_statusByPath.keys().next().value);
+    _statusByPath.set(path, { stamp: before, status });
+  }
+  return status;
+}

package/src/runtime/agent/orchestrator/session/store/save-fault.mjs

@@ -21,6 +21,7 @@
  *     another process's ACTIVE commit, which no registry here can see.
  */
 import { unlinkSync } from 'node:fs';
+import { renameAttempt } from '../../../../shared/atomic-file.mjs';
 import { basename } from 'node:path';
 import { _renameWithRetrySync } from './serialize.mjs';
 
@@ -318,3 +319,17 @@ export function _commitSessionWrite(tmp, target, id) {
   if (injected) throw injected;
   return _renameWithRetrySync(tmp, target);
 }
+
+/**
+ * One attempt of _commitSessionWrite's rename schedule (renameAttempt): null
+ * when the scratch file landed, else the delay before attempt + 1; throws the
+ * final error. The injected fault is taken once per commit, on attempt 0,
+ * exactly as _commitSessionWrite takes it.
+ */
+export function _commitSessionWriteAttempt(tmp, target, id, attempt) {
+  if (attempt === 0) {
+    const injected = _takeInjectedCommitFault(id);
+    if (injected) throw injected;
+  }
+  return renameAttempt(tmp, target, attempt);
+}

package/src/runtime/agent/orchestrator/session/store/session-paths.mjs

@@ -34,9 +34,21 @@ function _memoFilePath(dir, id, extension) {
   }
   return path;
 }
+// Every session path lookup ensured the store dir with a synchronous
+// existsSync: the agent-status pulse resolves hundreds of paths per beat, and
+// those probes alone held the daemon loop for seconds per minute. The check is
+// re-run at most once per interval; a dir removed in between is recreated by
+// the next check.
+const STORE_DIR_RECHECK_MS = 1000;
+let _ensuredStoreDir = null;
+let _ensuredStoreDirAt = 0;
 export function getStoreDir() {
   const dir = _storeDirPath();
+  const now = Date.now();
+  if (dir === _ensuredStoreDir && now - _ensuredStoreDirAt < STORE_DIR_RECHECK_MS) return dir;
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  _ensuredStoreDir = dir;
+  _ensuredStoreDirAt = now;
   return dir;
 }
 function _sessionFileName(id, extension) {

package/src/runtime/agent/orchestrator/session/store-agent-worker-header.mjs

@@ -0,0 +1,36 @@
+/**
+ * Top-level field read of a serialized session record without materializing
+ * its transcript.
+ *
+ * The agent pool needs a handful of top-level fields per worker session, yet
+ * `JSON.parse` of the whole record built every message object — megabytes per
+ * worker — on each rewrite the worker persisted. The record is instead proven
+ * valid by the strict grammar walk of store-record-strict-scan.mjs, which
+ * decodes only the requested members; a record it cannot prove (malformed,
+ * duplicate top-level keys, pretty-printed, non-object root) is read by the
+ * full parse itself.
+ *
+ * Contract: the result equals picking `fields` (in `fields` order, own
+ * properties only) from `JSON.parse(bytes.toString('utf8'))` when that is an
+ * object or an array (an array root picks none), and is `null` otherwise —
+ * a document the full parse rejects included.
+ */
+import { provenTopLevelObject } from './store-record-strict-scan.mjs';
+
+export function readTopLevelFields(bytes, fields) {
+  const wanted = new Set(fields);
+  let doc = provenTopLevelObject(bytes, (key) => wanted.has(key));
+  if (!doc) {
+    try {
+      doc = JSON.parse(bytes.toString('utf8'));
+    } catch {
+      return null;
+    }
+    if (!doc || typeof doc !== 'object') return null;
+  }
+  const picked = {};
+  for (const field of fields) {
+    if (Object.hasOwn(doc, field)) picked[field] = doc[field];
+  }
+  return picked;
+}

package/src/runtime/agent/orchestrator/session/store-agent-worker-rows.mjs

@@ -16,10 +16,17 @@
  * field name and row key is a consumed contract and is used verbatim.
  */
 import { readFileSync } from 'node:fs';
+import { readFile, stat } from 'node:fs/promises';
 import { join } from 'node:path';
-import { probePath, PROBE_PRESENT } from './store/fs-probe.mjs';
+import {
+  isSettledSessionStamp,
+  sameSessionStamp,
+  sessionStampOf,
+  statSessionStamp,
+} from './store/canonical-reader.mjs';
 import { readJsonProjection } from '../../../shared/pending-json-projection.mjs';
 import { listStoredAgentWorkers as assembleStoredAgentWorkers } from './store-agent-worker-pool.mjs';
+import { readTopLevelFields } from './store-agent-worker-header.mjs';
 import {
   TAG_TOMBSTONE_TTL_MS,
   agentPaneVisible,
@@ -166,16 +173,83 @@ function cancelStage(cancel, declaredStage) {
   return /^cancel/i.test(declaredStage) || CANCELLED_AGENT_STATUS.test(declaredStage) ? declaredStage : cancel.status;
 }
 
-function storedAgentWorkerIndex() {
-  const path = storedAgentWorkerIndexPath();
+// The worker indexes were re-parsed in full on every pool listing and ancestry
+// lookup, changed or not. Each keeps its last parse beside the bytes it came
+// from: the file is still read every time (a few hundred KB), but an
+// unchanged one — byte for byte, so no timestamp collision can serve a stale
+// document — reuses that parse.
+// Before the read, the full file stamp is checked under the same canonical
+// policy the session headers use: a file that still has the exact settled
+// { dev, ino, size, mtimeNs, ctimeNs } its bytes were proven to come from is
+// not read again (each pool listing re-read the whole index synchronously).
+const workerIndexCache = new Map(); // path -> { bytes, doc, stamp|null }
+// The index documents an asynchronous listing read before its (synchronous)
+// assembly; live only during that assembly.
+let passIndexes = null; // path -> doc | null
+
+function readWorkerIndexFile(path) {
+  if (passIndexes?.has(path)) return passIndexes.get(path);
   // This process's own queued (not yet persisted) writes win over the file.
   const projected = readJsonProjection(path);
   if (projected) return projected;
+  const before = observeStamp(path);
+  const cached = workerIndexCache.get(path);
+  if (before && cached?.stamp && sameSessionStamp(cached.stamp, before)) return cached.doc;
+  let bytes;
   try {
-    return JSON.parse(readFileSync(path, 'utf8'));
+    bytes = readFileSync(path);
   } catch {
+    workerIndexCache.delete(path);
     return null;
   }
+  const stamp = before && isSettledSessionStamp(before) && sameSessionStamp(before, observeStamp(path)) ? before : null;
+  if (cached?.bytes.equals(bytes)) {
+    cached.stamp = stamp;
+    return cached.doc;
+  }
+  let doc = null;
+  try {
+    doc = JSON.parse(bytes.toString('utf8'));
+  } catch {
+    /* malformed: no rows */
+  }
+  workerIndexCache.set(path, { bytes, doc, stamp });
+  return doc;
+}
+
+/** readWorkerIndexFile with every stat and read awaited, under the same
+ *  stamp and byte-equality cache. */
+async function readWorkerIndexFileAsync(path) {
+  const projected = readJsonProjection(path);
+  if (projected) return projected;
+  const before = await observeStampAsync(path);
+  const cached = workerIndexCache.get(path);
+  if (before && cached?.stamp && sameSessionStamp(cached.stamp, before)) return cached.doc;
+  let bytes;
+  try {
+    bytes = await readFile(path);
+  } catch {
+    workerIndexCache.delete(path);
+    return null;
+  }
+  const settled = before && isSettledSessionStamp(before);
+  const stamp = settled && sameSessionStamp(before, await observeStampAsync(path)) ? before : null;
+  if (cached?.bytes.equals(bytes)) {
+    cached.stamp = stamp;
+    return cached.doc;
+  }
+  let doc = null;
+  try {
+    doc = JSON.parse(bytes.toString('utf8'));
+  } catch {
+    /* malformed: no rows */
+  }
+  workerIndexCache.set(path, { bytes, doc, stamp });
+  return doc;
+}
+
+function storedAgentWorkerIndex() {
+  return readWorkerIndexFile(storedAgentWorkerIndexPath());
 }
 
 function storedAgentWorkerIndexRows() {
@@ -211,7 +285,8 @@ export function listStoredAgentWorkerLinks() {
 
 // The agent pool only reads top-level session fields, yet each refresh used to
 // JSON.parse every active worker's whole transcript (megabytes per worker,
-// every catalog publish). Cache the header per file fingerprint instead.
+// every catalog publish). Cache the header per full file stamp instead (see
+// probeWorkerSessionHeader).
 // The cache holds exactly the headers the latest pool assembly read: a fixed
 // LRU cap below the index size (263 headers against 256 slots) evicted every
 // entry just before its reuse, so each refresh re-parsed every worker
@@ -250,30 +325,120 @@ const WORKER_HEADER_FIELDS = [
   ...SESSION_CANCEL_FIELDS,
 ];
 
+// One assembly reads a session's header up to three times (reap check, row
+// projection, orphan prune); each read used to stat the file again. Within an
+// assembly the first answer stands, absent or unreadable included.
+let passHeaders = null; // path -> header | null, live only during an assembly
+
+function workerSessionHeaderPath(sessionId) {
+  return join(dataDir(), 'sessions', `${sessionId}.json`);
+}
+
 function readWorkerSessionHeader(sessionId) {
-  const path = join(dataDir(), 'sessions', `${sessionId}.json`);
-  const probe = probePath(path);
-  if (probe.state !== PROBE_PRESENT) return null;
+  const path = workerSessionHeaderPath(sessionId);
+  if (passHeaders?.has(path)) return passHeaders.get(path);
+  const header = probeWorkerSessionHeader(path);
+  passHeaders?.set(path, header);
+  return header;
+}
+
+let workerHeaderReads = 0;
+
+function observeStamp(path) {
+  try {
+    return statSessionStamp(path);
+  } catch {
+    return null;
+  }
+}
+
+// A header is reused only under the canonical full-stamp policy: the file
+// still has the exact { dev, ino, size, mtimeNs, ctimeNs } its bytes were
+// proven to come from (stat → read → stat), and that stamp was past the racy
+// window when read. Size + mtime alone let an equal-length rewrite that kept
+// its mtime serve stale ownership, status and cancel fields.
+function probeWorkerSessionHeader(path) {
+  // Absent and unreadable alike: no header.
+  const before = observeStamp(path);
+  if (!before) return null;
   const cached = workerSessionHeaderCache.get(path);
-  if (cached && cached.mtimeMs === probe.mtimeMs && cached.size === probe.size) {
+  if (cached && sameSessionStamp(cached.stamp, before)) {
     cached.pass = headerPass;
     return cached.header;
   }
-  let session = null;
+  workerSessionHeaderCache.delete(path);
+  // A rewrite re-reads only this record, and only its top-level fields are
+  // decoded: the transcript bytes are validated, never materialized.
+  let header = null;
+  try {
+    header = readTopLevelFields(readFileSync(path), WORKER_HEADER_FIELDS);
+  } catch {
+    return null;
+  }
+  if (!header) return null;
+  workerHeaderReads += 1;
+  if (isSettledSessionStamp(before) && sameSessionStamp(before, observeStamp(path))) {
+    workerSessionHeaderCache.set(path, { stamp: before, header, pass: headerPass });
+  }
+  return header;
+}
+
+async function observeStampAsync(path) {
+  try {
+    return sessionStampOf(await stat(path, { bigint: true }));
+  } catch {
+    return null;
+  }
+}
+
+/** probeWorkerSessionHeader with every stat and read awaited, under the
+ *  same full-stamp cache policy. */
+async function probeWorkerSessionHeaderAsync(path) {
+  const before = await observeStampAsync(path);
+  if (!before) return null;
+  const cached = workerSessionHeaderCache.get(path);
+  if (cached && sameSessionStamp(cached.stamp, before)) return cached.header;
+  workerSessionHeaderCache.delete(path);
+  let header = null;
   try {
-    session = JSON.parse(readFileSync(path, 'utf8'));
+    header = readTopLevelFields(await readFile(path), WORKER_HEADER_FIELDS);
   } catch {
     return null;
   }
-  if (!session || typeof session !== 'object') return null;
-  const header = {};
-  for (const field of WORKER_HEADER_FIELDS) {
-    if (Object.hasOwn(session, field)) header[field] = session[field];
+  if (!header) return null;
+  workerHeaderReads += 1;
+  if (isSettledSessionStamp(before) && sameSessionStamp(before, await observeStampAsync(path))) {
+    workerSessionHeaderCache.set(path, { stamp: before, header, pass: headerPass });
   }
-  workerSessionHeaderCache.set(path, { mtimeMs: probe.mtimeMs, size: probe.size, header, pass: headerPass });
   return header;
 }
 
+// Header reads in flight at once: each is a stat (and a read only when the
+// file changed) on the shared libuv pool, which other file I/O also needs.
+const HEADER_READ_CONCURRENCY = 4;
+
+async function prefetchWorkerHeaders(sessionIds, headers) {
+  const paths = [...new Set([...sessionIds].map(workerSessionHeaderPath))].filter((path) => !headers.has(path));
+  let next = 0;
+  const drain = async () => {
+    while (next < paths.length) {
+      const path = paths[next++];
+      headers.set(path, await probeWorkerSessionHeaderAsync(path));
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(HEADER_READ_CONCURRENCY, paths.length) }, drain));
+}
+
+/** Test/diagnostic seam: cached headers and the records this process read. */
+export function storedAgentWorkerHeaderStats() {
+  return {
+    entries: workerSessionHeaderCache.size,
+    reads: workerHeaderReads,
+    stickyIdle: stickyIdleSince.size,
+    indexes: workerIndexCache.size,
+  };
+}
+
 /** Owner record of a child row that is a Lead CONVERSATION. Only such an owner
  *  lets a missing pool row mean "the Lead's lease expired"; an Agent-owned or
  *  unreadable owner keeps its child rows visible exactly as before. */
@@ -377,16 +542,8 @@ function projectChildWorkerRow(row, context) {
 }
 
 function storedLeadWorkerRows() {
-  const path = storedLeadWorkerIndexPath();
-  let parsed = readJsonProjection(path);
-  if (!parsed) {
-    try {
-      parsed = JSON.parse(readFileSync(path, 'utf8'));
-    } catch {
-      /* no resident Lead pool */
-    }
-  }
-  return workerRows(parsed);
+  // Absent or unreadable: no resident Lead pool.
+  return workerRows(readWorkerIndexFile(storedLeadWorkerIndexPath()));
 }
 
 /** A Lead-index row whose durable session turned out to be an agent's.
@@ -464,6 +621,72 @@ function pruneOrphanChildRows(bySessionId, { liveLeadSessionIds }) {
  * never projected into either pool. `runningSessionIds` is the daemon's set of
  * sessions whose turn is in flight; omitted, no row is shown as running. */
 export function listStoredAgentWorkers({ runningSessionIds = null } = {}) {
+  headerPass += 1;
+  passHeaders = new Map();
+  try {
+    return assembleListedWorkers(runningSessionIds);
+  } finally {
+    passHeaders = null;
+    forgetUnreadHeaders();
+  }
+}
+
+// Keep what the latest assembly read, whatever the index size; forget the rest.
+function forgetUnreadHeaders() {
+  for (const [path, entry] of workerSessionHeaderCache) {
+    if (entry.pass !== headerPass) workerSessionHeaderCache.delete(path);
+  }
+}
+
+/** listStoredAgentWorkers without blocking the event loop on the store: both
+ *  indexes and every header the assembly can consult (each row's session,
+ *  each Lead row's, and each child's owner) are read first with awaited
+ *  stats and reads; the assembly then runs over what was read, with no file
+ *  access left in it (any header it still asks for falls back to a read).
+ *  `runningSessionIds` may be a function, asked once the reads are done. */
+export async function listStoredAgentWorkersAsync({ runningSessionIds = null } = {}) {
+  const agentIndexPath = storedAgentWorkerIndexPath();
+  const leadIndexPath = storedLeadWorkerIndexPath();
+  const [agentIndex, leadIndex] = await Promise.all([
+    readWorkerIndexFileAsync(agentIndexPath),
+    readWorkerIndexFileAsync(leadIndexPath),
+  ]);
+  const headers = new Map();
+  const childRows = workerRows(agentIndex);
+  const sessionIds = new Set(childRows.map((row) => cleanValue(row?.sessionId)));
+  for (const row of workerRows(leadIndex)) {
+    const sessionId = cleanValue(row?.sessionId);
+    if (sessionId && isStoredSessionId(sessionId)) sessionIds.add(sessionId);
+  }
+  await prefetchWorkerHeaders(sessionIds, headers);
+  const owners = new Set();
+  for (const row of childRows) {
+    const header = headers.get(workerSessionHeaderPath(cleanValue(row?.sessionId)));
+    const owner = row && typeof row === 'object' ? workerOwnerSessionId(row, header) : null;
+    if (owner) owners.add(owner);
+  }
+  await prefetchWorkerHeaders(owners, headers);
+  const running = typeof runningSessionIds === 'function' ? runningSessionIds() : runningSessionIds;
+  headerPass += 1;
+  for (const path of headers.keys()) {
+    const entry = workerSessionHeaderCache.get(path);
+    if (entry) entry.pass = headerPass;
+  }
+  passHeaders = headers;
+  passIndexes = new Map([
+    [agentIndexPath, agentIndex],
+    [leadIndexPath, leadIndex],
+  ]);
+  try {
+    return assembleListedWorkers(running);
+  } finally {
+    passHeaders = null;
+    passIndexes = null;
+    forgetUnreadHeaders();
+  }
+}
+
+function assembleListedWorkers(runningSessionIds) {
   const now = Date.now();
   const index = storedAgentWorkerIndex();
   const rows = workerRows(index);
@@ -487,21 +710,13 @@ export function listStoredAgentWorkers({ runningSessionIds = null } = {}) {
     };
     return tombstoneBlocksWork(work, findTagTombstone(work, tombstones));
   };
-  headerPass += 1;
-  try {
-    return assembleStoredAgentWorkers({
-      now,
-      runningSessionIds,
-      storedAgentWorkerIndexRows: () => rows.filter((row) => !isReaped(cleanValue(row.sessionId))),
-      projectChildWorkerRow,
-      storedLeadWorkerRows,
-      projectLeadWorkerRow,
-      pruneOrphanChildRows,
-    });
-  } finally {
-    // Keep what this assembly read, whatever the index size; forget the rest.
-    for (const [path, entry] of workerSessionHeaderCache) {
-      if (entry.pass !== headerPass) workerSessionHeaderCache.delete(path);
-    }
-  }
+  return assembleStoredAgentWorkers({
+    now,
+    runningSessionIds,
+    storedAgentWorkerIndexRows: () => rows.filter((row) => !isReaped(cleanValue(row.sessionId))),
+    projectChildWorkerRow,
+    storedLeadWorkerRows,
+    projectLeadWorkerRow,
+    pruneOrphanChildRows,
+  });
 }