mixdog 1.3.1 → 1.3.2

package/src/runtime/shared/bot-hops.mjs

@@ -0,0 +1,30 @@
+// Bot-to-bot chain budget. Every send a bot makes carries `hop` (stored in the
+// transcript meta of the message it delivers, and in the report that answers
+// it). A turn knows the hop of the submission that started it (`turnHop`,
+// stamped on the session when the turn is prepared); a send made in it goes
+// out at turnHop + 1. A turn started by the user or by a routine starts at 0;
+// a runtime notification keeps the hop of the work it belongs to.
+export const MAX_BOT_HOPS = 3;
+export const BOT_HOP_LIMIT_ERROR = 'session: Bot-to-bot chain limit reached; ask the user before continuing.';
+
+const hopOf = (value) => (Number.isInteger(value) && value > 0 ? value : 0);
+
+/** The hop a turn starts at: its submission's own, else (a runtime
+ *  notification, `runtimeSource`) the hop the session was already at, else 0. */
+export function startingTurnHop(transcriptMeta, runtimeSource, previous) {
+  return hopOf(transcriptMeta?.hop) || (runtimeSource ? hopOf(previous) : 0);
+}
+
+/** Stamp the starting hop on `session` for the turn about to run. */
+export function stampTurnHop(session, transcriptMeta, runtimeSource) {
+  session.turnHop = startingTurnHop(transcriptMeta, runtimeSource, session.turnHop);
+}
+
+/** A bot's message steered into the running turn raises the turn's hop. */
+export function raiseTurnHop(session, transcriptMeta) {
+  const hop = hopOf(transcriptMeta?.hop);
+  if (session && hop > hopOf(session.turnHop)) session.turnHop = hop;
+}
+
+/** The hop of the turn `session` is in. */
+export const turnHopOf = (session) => hopOf(session?.turnHop);

package/src/runtime/shared/bot-split-migration.mjs

@@ -83,7 +83,7 @@ function writeJson(file, value) {
 
 // The definition file a bot's kind is read from: AGENT.md, or the archived
 // copy of a deleted bot (its chat is kept, so it moves with the others).
-function definitionFile(dir) {
+export function definitionFile(dir) {
   if (existsSync(join(dir, 'AGENT.md'))) return join(dir, 'AGENT.md');
   if (existsSync(join(dir, DELETED_MARKER)) && existsSync(join(dir, ARCHIVED_FILE))) return join(dir, ARCHIVED_FILE);
   return '';

package/src/runtime/shared/bounded-download.mjs

@@ -55,7 +55,7 @@ export async function readResponseBuffer(response, { maxBytes, label = 'download
 export async function streamResponseToFile(
   response,
   destPath,
-  { maxBytes, expectedBytes = 0, label = 'download', onProgress = null } = {}
+  { maxBytes, expectedBytes = 0, label = 'download', onProgress = null, signal = undefined } = {}
 ) {
   const { maximum, expected } = downloadBounds(maxBytes, expectedBytes, label);
   const advertised = responseByteLength(response, maximum, label);
@@ -94,7 +94,9 @@ export async function streamResponseToFile(
   });
 
   try {
-    await pipeline(response.body, guard, createWriteStream(destPath));
+    // flush: the bytes reach disk before the caller installs the file, so a
+    // crash cannot leave an installed binary that is all NUL.
+    await pipeline(response.body, guard, createWriteStream(destPath, { flush: true }), { signal });
     return downloaded;
   } catch (error) {
     try {

package/src/runtime/shared/config.mjs

@@ -2,12 +2,14 @@
  * Unified config reader/writer.
  * Single file: mixdog-config.json with sections such as channels, agent, and memory.
  */
-import { readFileSync, statSync, mkdirSync, existsSync, watch as fsWatch } from 'node:fs';
-import { join, dirname } from 'node:path';
+import { readFileSync, readdirSync, statSync, mkdirSync, existsSync, watch as fsWatch } from 'node:fs';
+import { basename, join, dirname } from 'node:path';
 import { createRequire } from 'node:module';
 import { resolvePluginData } from './plugin-paths.mjs';
 import { hasOwn, isPlainObject } from './object.mjs';
 import {
+  parseJsonText,
+  quarantinePath,
   renameWithRetrySync,
   writeJsonAtomicSync,
   writeJsonAtomicAsync,
@@ -226,7 +228,7 @@ function readConfigFile() {
   const raw = readConfigRawCached();
   if (raw == null) return null;
   try {
-    return JSON.parse(raw);
+    return parseJsonText(raw);
   } catch (err) {
     // Quarantine a malformed mixdog-config.json so the next boot starts fresh
     // instead of looping on a broken file. A cached raw string that fails to
@@ -346,21 +348,47 @@ function readAll() {
 }
 
 function quarantineMalformedConfig(parseErr) {
-  const corrupt = `${configPath()}.corrupt-${Date.now()}`;
+  const corrupt = quarantinePath(configPath());
+  let keptAside = false;
   try {
     if (existsSync(configPath())) renameWithRetrySync(configPath(), corrupt);
+    keptAside = existsSync(corrupt);
   } catch {}
   process.stderr.write(
     `[config] mixdog-config.json is malformed (${parseErr.message}). Renamed to ${corrupt}. Restore it or delete to start fresh.\n`
   );
+  return keptAside;
 }
 
-function restoreAllForRmWOrThrow(reason) {
+// A damaged config that was kept aside (its bytes preserved as
+// mixdog-config.json.corrupt-<ts>) is not a lost config: those bytes are the
+// safety net, so with no backup to restore a save may start from an empty
+// config. Every save also snapshots a backup, so a stale copy from an earlier
+// incident never reaches this point while a backup of a later config exists.
+function hasQuarantinedCopy() {
+  const dir = dirname(configPath());
+  const prefix = `${basename(configPath())}.corrupt-`;
+  try {
+    return readdirSync(dir).some((name) => name.startsWith(prefix));
+  } catch {
+    return false;
+  }
+}
+
+// `keptAside`: the unusable config's bytes are preserved on disk, so with no
+// backup to restore a save starts from an empty config instead of refusing.
+function restoreAllForRmWOrThrow(reason, keptAside = false) {
   const restored = loadLatestMixdogConfigFromBackup(resolvePluginData(), { fresh: true });
   if (restored && isPlainObject(restored)) {
     process.stderr.write(`[config] RMW read: restored mixdog-config.json from latest user-data backup (${reason})\n`);
     return restored;
   }
+  if (keptAside) {
+    process.stderr.write(
+      `[config] RMW read: mixdog-config.json is unusable (${reason}); its bytes are kept aside and no backup exists; starting empty\n`
+    );
+    return {};
+  }
   const legacy = findLegacyUserDataEvidence(resolvePluginData(), { fresh: true });
   if (legacy) {
     const err = new Error(
@@ -381,6 +409,9 @@ function restoreAllForRmWOrThrow(reason) {
  * Read-modify-write baseline. ENOENT on a never-initialized data dir → {}.
  * Malformed on-disk config (or missing config after prior init) → restore
  * from backup or throw; never silently collapse to a one-section overwrite.
+ * The exception is a damaged config whose bytes were kept aside as
+ * .corrupt-<ts>: with no backup to restore, the save starts from an empty
+ * config. A config that cannot be READ (I/O error) still throws.
  */
 function readAllForRmW() {
   let raw;
@@ -389,7 +420,7 @@ function readAllForRmW() {
   } catch (err) {
     if (err.code === 'ENOENT') {
       if (isUserDataRecoveryExpected(resolvePluginData(), { fresh: true })) {
-        return restoreAllForRmWOrThrow('config file missing after user-data was initialized');
+        return restoreAllForRmWOrThrow('config file missing after user-data was initialized', hasQuarantinedCopy());
       }
       return {};
     }
@@ -397,12 +428,11 @@ function readAllForRmW() {
     throw err;
   }
   try {
-    const parsed = JSON.parse(raw);
+    const parsed = parseJsonText(raw);
     if (!isPlainObject(parsed)) throw new SyntaxError('config root must be a JSON object');
     return parsed;
   } catch (parseErr) {
-    quarantineMalformedConfig(parseErr);
-    return restoreAllForRmWOrThrow(parseErr.message);
+    return restoreAllForRmWOrThrow(parseErr.message, quarantineMalformedConfig(parseErr));
   }
 }
 

package/src/runtime/shared/defaults-separation.mjs

@@ -11,9 +11,10 @@
  * Left untouched on purpose: `desktop`, credentials, onboarding, detection and
  * install flags, caches, and keys that are only ever hand-edited.
  */
-import { constants, copyFileSync, existsSync, mkdirSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
+import { writeFileAtomicSync } from './atomic-file.mjs';
 import { packDefinitionFromDir } from './shipped-definitions.mjs';
 import { resolvePluginData } from './plugin-paths.mjs';
 import { hasOwn, isPlainObject } from './object.mjs';
@@ -231,7 +232,10 @@ export function backupConfigBeforeDefaultsSeparation({ dataDir = resolvePluginDa
       throw err;
     }
     const target = join(dir, 'mixdog-config.json');
-    copyFileSync(source, target, constants.COPYFILE_EXCL);
+    // Written through an fsynced handle (a plain copy can leave this backup NUL
+    // exactly when a crash makes it needed); the folder was claimed above, so
+    // nothing can exist at `target`.
+    writeFileAtomicSync(target, readFileSync(source), { mode: statSync(source).mode & 0o777 });
     return target;
   }
 }

package/src/runtime/shared/delegated-approval-host.mjs

@@ -0,0 +1,74 @@
+// Delegated approvals: a sub-agent's approval request (tui/session/tool-approval.mjs)
+// is also shown in the top-level conversation the user watches — the root bot's
+// home chat, or the coding Lead's session (human-gate/gate.mjs approvalSurface).
+// It stays ONE request: the sub-agent's queue owns it and its waiter; the
+// top-level session's queue holds a copy whose answer is forwarded to that
+// owner, and the copy is withdrawn as soon as the owner settles (answered in
+// either place, timed out, its turn ended). Like held-request-host.mjs this
+// registry is process-wide and dependency-free.
+
+const KEY = Symbol.for('mixdog.delegatedApprovalHost.v1');
+
+function registry() {
+  globalThis[KEY] ??= { queues: new Set(), pending: new Map(), opener: null };
+  return globalThis[KEY];
+}
+
+/** `queue`: `{ sessionId() → string, disposed() → boolean, offer(delegated),
+ *  withdraw(id, result) }` — one session runtime's approval queue. */
+export function registerApprovalQueue(queue) {
+  registry().queues.add(queue);
+  return () => registry().queues.delete(queue);
+}
+
+/** `open(sessionId) → Promise`: brings a session's runtime up (the daemon's
+ *  session service), so a top-level chat that is not loaded can show the copy. */
+export function registerDelegatedApprovalOpener(open) {
+  registry().opener = open;
+  return () => {
+    if (registry().opener === open) registry().opener = null;
+  };
+}
+
+function liveQueuesOf(sessionId) {
+  const { queues } = registry();
+  const live = [];
+  for (const queue of queues) {
+    if (queue.disposed()) queues.delete(queue);
+    else if (queue.sessionId() === sessionId) live.push(queue);
+  }
+  return live;
+}
+
+function offerTo(sessionId, delegated) {
+  const live = liveQueuesOf(sessionId);
+  for (const queue of live) queue.offer(delegated);
+  return live.length > 0;
+}
+
+/** Show `delegated` (`{ id, sessionId, request, answer(...finishArgs) → boolean }`,
+ *  `sessionId` being the top-level conversation) there, now or once it loads. */
+export function delegateApproval(delegated) {
+  const { pending, opener } = registry();
+  pending.set(delegated.id, delegated);
+  if (offerTo(delegated.sessionId, delegated) || typeof opener !== 'function') return;
+  void Promise.resolve()
+    .then(() => opener(delegated.sessionId))
+    .then(() => {
+      if (pending.get(delegated.id) === delegated) offerTo(delegated.sessionId, delegated);
+    })
+    .catch(() => {});
+}
+
+/** The owner settled `id`: every copy goes away. `result` (`{ approved, device }`)
+ *  lets the copy say who answered. */
+export function withdrawDelegatedApproval(id, result = null) {
+  const { pending, queues } = registry();
+  if (!pending.delete(id)) return;
+  for (const queue of queues) queue.withdraw(id, result);
+}
+
+/** The pending delegated approvals a top-level session should show. */
+export function delegatedApprovalsFor(sessionId) {
+  return [...registry().pending.values()].filter((delegated) => delegated.sessionId === sessionId);
+}

package/src/runtime/shared/err-text.mjs

@@ -257,6 +257,10 @@ export function presentErrorText(error, options = {}) {
   if (code === 'TOOL_SURFACE_EXCEEDS_CONTEXT' || /\(TOOL_SURFACE_EXCEEDS_CONTEXT\)/.test(text)) {
     return stripErrorPrefix(text);
   }
+  // Likewise a latest message that cannot fit names its size and what would
+  // help; a wrapper's prefix ("agent compact failed (...): ") is dropped.
+  const latestTurn = /The latest message cannot fit this model \(LATEST_TURN_EXCEEDS_CONTEXT\)[\s\S]*$/.exec(text);
+  if (latestTurn) return latestTurn[0].replace(' (LATEST_TURN_EXCEEDS_CONTEXT)', '');
   const jsonError = extractJsonError(text);
   if (jsonError) text = jsonError;
   const embeddedError = extractEmbeddedError(text);

package/src/runtime/shared/error-presentation.mjs

@@ -3,10 +3,14 @@ import { transportErrorText } from './transport-error-text.mjs';
 
 const DETAILS_LIMIT = 12_000;
 const SUMMARY_LIMIT = 180;
+// "<wrapper>: The latest message cannot fit this model (CODE): <sizes>. <cause and remedy>"
+const LATEST_TURN_RE =
+  /The latest message cannot fit this model \(LATEST_TURN_EXCEEDS_CONTEXT\)(: it needs about [\d,]+ tokens, but the [^.]* window leaves [\d,]+ for it\.)([\s\S]*)$/;
 
 /** Diagnostic text must be safe before it reaches a view, copy button or log. */
 export function safeErrorDetails(value) {
   let text = String(value ?? '')
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: strips ANSI escape sequences (ESC) from diagnostic text
     .replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, '')
     .replace(/\r\n?/g, '\n')
     .replace(/\b((?:https?|ssh):\/\/)[^/\s@]+@/gi, '$1[redacted]@')
@@ -135,7 +139,9 @@ function resetLabel(resetAt) {
   const reset = new Date(resetAt);
   const pad = (n) => String(n).padStart(2, '0');
   const time = `${pad(reset.getHours())}:${pad(reset.getMinutes())}`;
-  return reset.toDateString() === new Date().toDateString() ? time : `${reset.getMonth() + 1}/${reset.getDate()} ${time}`;
+  return reset.toDateString() === new Date().toDateString()
+    ? time
+    : `${reset.getMonth() + 1}/${reset.getDate()} ${time}`;
 }
 
 // A refused request that names its model as unknown, retired or not offered
@@ -286,7 +292,9 @@ export function describeError(value) {
   if (
     value?.reauthRequired === true ||
     (!typed &&
-      /invalid_grant|refresh token (?:expired|revoked|not available)|sign in again|sign-in expired|Reauth Required/i.test(raw))
+      /invalid_grant|refresh token (?:expired|revoked|not available)|sign in again|sign-in expired|Reauth Required/i.test(
+        raw
+      ))
   ) {
     kind = 'reauth';
     summary = 'Sign-in expired.';
@@ -294,7 +302,9 @@ export function describeError(value) {
   } else if (
     descriptor.kind === 'auth' ||
     (descriptor.kind === 'unknown' &&
-      /\b(?:invalid|expired)\s+(?:api[ _-]?key|access token|credentials?)\b|Provider authentication failed/i.test(clean))
+      /\b(?:invalid|expired)\s+(?:api[ _-]?key|access token|credentials?)\b|Provider authentication failed/i.test(
+        clean
+      ))
   ) {
     kind = 'authentication';
     summary = 'Provider authentication failed';
@@ -331,6 +341,13 @@ export function describeError(value) {
     kind = 'not-found';
     summary = firstReadableLine(clean) || NOT_FOUND_SUMMARY;
     recovery = MODEL_UNAVAILABLE_COPY[2];
+  } else if (LATEST_TURN_RE.test(clean)) {
+    // The latest message cannot fit the window (compact/runner.mjs): the
+    // sizes are the headline, the cause and remedy the next step.
+    const [, headline, rest] = LATEST_TURN_RE.exec(clean);
+    kind = 'latest-turn-size';
+    summary = `The latest message cannot fit this model${headline}`;
+    recovery = rest.trim();
   } else if (
     descriptor.kind === 'unknown' &&
     /payload too large|request (?:body )?too large|The request exceeds the size limit/i.test(clean)
@@ -366,6 +383,7 @@ export function describeError(value) {
   }
   summary = summary.replace(/\s+/g, ' ').trim() || 'Something went wrong.';
   if (summary.length > SUMMARY_LIMIT) summary = `${summary.slice(0, SUMMARY_LIMIT - 1).trimEnd()}…`;
+  const fingerprintStatus = kind === 'reauth' ? '' : status || '';
   return {
     kind,
     summary,
@@ -378,6 +396,6 @@ export function describeError(value) {
     details,
     // Known structured failures ignore volatile indexes; unknown failures
     // retain their diagnostic identity rather than merging unrelated work.
-    fingerprint: kind === 'unknown' ? details : `${kind}:${kind === 'reauth' ? '' : status || ''}`,
+    fingerprint: kind === 'unknown' ? details : `${kind}:${fingerprintStatus}`,
   };
 }

package/src/runtime/shared/file-has-data.mjs

@@ -0,0 +1,28 @@
+import { closeSync, openSync, readSync } from 'node:fs';
+import { holdsNoData } from './atomic-file.mjs';
+
+const PROBE_BYTES = 4096;
+
+/**
+ * Install check for a downloaded binary or model: false when `path` is absent
+ * or its first bytes hold no data (empty, or NUL-filled by a crash that
+ * committed the size but not the bytes). Cheaper than hashing a multi-GB file
+ * on every use. A file that exists but cannot be opened right now (locked by a
+ * scanner or by the process running it) still counts as present.
+ */
+export function fileHasData(path) {
+  let fd;
+  try {
+    fd = openSync(path, 'r');
+    const head = Buffer.alloc(PROBE_BYTES);
+    return !holdsNoData(head.subarray(0, readSync(fd, head, 0, PROBE_BYTES, 0)));
+  } catch (err) {
+    return err?.code !== 'ENOENT' && err?.code !== 'ENOTDIR';
+  } finally {
+    if (fd !== undefined) {
+      try {
+        closeSync(fd);
+      } catch {}
+    }
+  }
+}

package/src/runtime/shared/llm/usage-ledger-import.mjs

@@ -114,7 +114,7 @@ export async function importUsageHistory(ledger, dataDir, { now = Date.now(), re
   // send's diagnostic copy cannot also enter as historical usage.
   const until = Number(ledger.get('liveSince')) || now;
   if (Number(ledger.get('importedThrough')) >= until) return { skipped: true };
-  const result = { inserted: 0, sourceRows: 0, unrecordableRows: 0, files: [], traceRows: 0 };
+  const result = { inserted: 0, sourceRows: 0, unrecordableRows: 0, tornTraceLines: 0, files: [], traceRows: 0 };
   const accept = (rows) => {
     const normalized = [];
     for (const raw of rows) {
@@ -140,15 +140,23 @@ export async function importUsageHistory(ledger, dataDir, { now = Date.now(), re
     const original = await readFile(path, 'utf8');
     const lines = original.split(/\r?\n/);
     const rows = [];
+    let torn = 0;
     for (let i = 0; i < lines.length; i++) {
       if (!lines[i].trim()) continue;
       let row;
       try {
         row = JSON.parse(lines[i]);
       } catch {
-        throw new Error(`Incomplete or invalid trace record: ${path}:${i + 1}`);
+        // An append a crash tore (cut short, or NUL-filled) is no record: skip
+        // it, like the gateway store below, instead of failing every import.
+        torn += 1;
+        continue;
       }
-      if (row.kind === 'usage_raw' || row.kind === 'usage') rows.push(row);
+      if (row?.kind === 'usage_raw' || row?.kind === 'usage') rows.push(row);
+    }
+    if (torn > 0) {
+      process.stderr.write(`[usage-ledger] warning: ${path} has ${torn} torn trace line(s); skipped\n`);
+      result.tornTraceLines += torn;
     }
     accept(rows);
     result.files.push({ path, sha256: createHash('sha256').update(original).digest('hex'), rows: rows.length });
@@ -160,29 +168,40 @@ export async function importUsageHistory(ledger, dataDir, { now = Date.now(), re
   // The JSONL store supersedes the legacy JSON file (it is migrated from it).
   const gatewayJsonl = await optionalFile(join(dataDir, 'gateway-usage.local.jsonl'));
   const gateway = gatewayJsonl === null ? await optionalFile(join(dataDir, 'gateway-usage.local.json')) : null;
-  if (gatewayJsonl !== null || gateway)
+  // A missing file is absence. Empty, unparsable, or wrong-shaped JSON is not:
+  // skip only that legacy import and leave importedThrough unset so a repair
+  // is retried instead of short-circuiting forever.
+  let legacyReady = true;
+  let gatewayEvents = null;
+  if (gatewayJsonl !== null) {
+    gatewayEvents = gatewayJsonl.split('\n').flatMap((line) => {
+      try {
+        return line.trim() ? [JSON.parse(line)] : [];
+      } catch {
+        return []; // torn append
+      }
+    });
+  } else if (gateway !== null) {
+    try {
+      const events = JSON.parse(gateway)?.events;
+      gatewayEvents = Array.isArray(events) ? events : [];
+    } catch (error) {
+      legacyReady = false;
+      process.stderr.write(
+        `[usage-ledger] warning: legacy gateway usage file gateway-usage.local.json is empty or corrupt (${error.message}); skipping its import\n`
+      );
+    }
+  }
+  if (gatewayEvents)
     accept(
-      (gatewayJsonl !== null
-        ? gatewayJsonl.split('\n').flatMap((line) => {
-            try {
-              return line.trim() ? [JSON.parse(line)] : [];
-            } catch {
-              return []; // torn append
-            }
-          })
-        : JSON.parse(gateway).events || []
-      ).map((event) => ({
+      gatewayEvents.map((event) => ({
         ...event,
         kind: 'usage',
         session_id: event.sessionId,
       }))
     );
-  // A missing file is absence. Empty, unparsable, or wrong-shaped JSON is not:
-  // skip only this legacy import and leave importedThrough unset so a repair
-  // is retried instead of short-circuiting forever.
   const legacyPath = join(dataDir, 'usage-rollup.local.json');
   const legacy = await optionalFile(legacyPath);
-  let legacyReady = true;
   if (legacy !== null) {
     let days;
     try {

package/src/runtime/shared/pending-agent-work.mjs

@@ -0,0 +1,54 @@
+// Which Lead sessions still wait on agent work they handed off: the rule the
+// desktop turn notifier applies to the agent pool (apps/desktop
+// shared/agent-activity.ts isActiveDesktopAgentEntry /
+// isCancelUnconfirmedDesktopAgentEntry, main/push-turn-events.ts
+// sessionsWithPendingWork), ported for the runtime so a bot's task-session
+// report waits for the same final answer the desktop notifies. Pool rows are
+// listStoredAgentWorkersAsync rows (`sessionId`, root `ownerSessionId`,
+// `status`, `stage`); nested descendants keep the Lead as their owner.
+
+const TERMINAL_STATUS = /idle|done|complete|success|closed|error|fail|cancel|killed|timeout/i;
+const ACTIVE_STATUS =
+  /^(?:connecting|requesting|streaming|tool[-_\s]?running|running|queued|pending|starting|resource_wait)$/i;
+const CANCELLED_STATUS = /cancel|killed|aborted|interrupted/i;
+const CANCEL_UNCONFIRMED_STATUS = /cancel[-_\s]?(?:unconfirmed|pending)|cancell?ing/i;
+
+const record = (value) => (value && typeof value === 'object' && !Array.isArray(value) ? value : {});
+
+function statusValues(value) {
+  const entry = record(value);
+  return [entry.stage, entry.status]
+    .map((status) => String(status || '').trim())
+    .filter((status, index, values) => Boolean(status) && values.indexOf(status) === index);
+}
+
+/** A running or queued row: `status` decides, `stage` only for a row without one. */
+function isActiveAgentRow(value) {
+  const statuses = statusValues(value);
+  if (statuses.length === 0 || statuses.some((status) => CANCELLED_STATUS.test(status))) return false;
+  const lifecycle = String(record(value).status || '').trim() || statuses[0];
+  return !TERMINAL_STATUS.test(lifecycle) && ACTIVE_STATUS.test(lifecycle);
+}
+
+/** A cancel whose stop is not proven yet. */
+function isCancelUnconfirmedAgentRow(value) {
+  return statusValues(value).some((status) => CANCEL_UNCONFIRMED_STATUS.test(status));
+}
+
+/** Agent work still in flight on one pool row. */
+export function hasPendingAgentWork(value) {
+  return isActiveAgentRow(value) || isCancelUnconfirmedAgentRow(value);
+}
+
+/** The owner (Lead) session ids with a child row still in flight. The Lead's
+ *  own row is skipped: its turn state comes from the session itself. */
+export function sessionsWithPendingWork(rows) {
+  const pending = new Set();
+  for (const row of Array.isArray(rows) ? rows : []) {
+    const sessionId = String(row?.sessionId || '');
+    const ownerSessionId = String(row?.ownerSessionId || '') || sessionId;
+    if (!ownerSessionId || sessionId === ownerSessionId) continue;
+    if (hasPendingAgentWork(row)) pending.add(ownerSessionId);
+  }
+  return pending;
+}

package/src/runtime/shared/process-lifecycle.mjs

@@ -1,7 +1,6 @@
 import {
   closeSync,
   existsSync,
-  fsyncSync,
   mkdirSync,
   openSync,
   readFileSync,
@@ -15,7 +14,7 @@ import {
 import { join } from 'node:path';
 import { execFile } from 'node:child_process';
 import { isDeepStrictEqual, promisify } from 'node:util';
-import { withFileLock, withFileLockSync } from './atomic-file.mjs';
+import { withFileLock, withFileLockSync, writeJsonAtomicSync } from './atomic-file.mjs';
 import { resolvePluginData } from './plugin-paths.mjs';
 
 const execFileAsync = promisify(execFile);
@@ -338,24 +337,21 @@ function markerOwned(active) {
 function writeMarker(active) {
   try {
     mkdirSync(active.markerDir, { recursive: true, mode: 0o700 });
-    writeFileSync(
+    // Flushed through the handle that wrote it: reopening the file read-only to
+    // fsync it is refused on Windows (EPERM), which reported a failure after
+    // the marker was already written.
+    writeJsonAtomicSync(
       active.markerPath,
-      `${JSON.stringify({
+      {
         version: 1,
         timestamp: new Date().toISOString(),
         pid: process.pid,
         ppid: process.ppid,
         token: active.token,
         processIdentity: active.processIdentity,
-      })}\n`,
-      { encoding: 'utf8', mode: 0o600 }
+      },
+      { compact: true, mode: 0o600 }
     );
-    const fd = openSync(active.markerPath, 'r');
-    try {
-      fsyncSync(fd);
-    } finally {
-      closeSync(fd);
-    }
     return true;
   } catch {
     return false;