mixdog 1.3.1 → 1.3.2

package/src/runtime/shared/projects.mjs

@@ -8,9 +8,9 @@
  * Data shape: { projects: [{ name, path, addedAt, lastSelectedAt? }] }
  */
 import { homedir } from 'node:os';
-import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, statSync } from 'node:fs';
 import { basename, isAbsolute, join, resolve } from 'node:path';
-import { withFileLockSync, writeJsonAtomicSync } from './atomic-file.mjs';
+import { holdsNoData, readJsonStateSync, updateJsonAtomicSync, writeFileAtomicSync } from './atomic-file.mjs';
 
 const MIXDOG_HOME = process.env.MIXDOG_HOME || join(homedir(), '.mixdog');
 const PROJECTS_FILE = process.env.MIXDOG_PROJECTS_FILE
@@ -30,47 +30,57 @@ function normalizeKey(absPath) {
   return process.platform === 'win32' ? text.replace(/[\\/]+$/, '').toLowerCase() : text.replace(/\/+$/, '');
 }
 
+// The registry document as a store. A strict read (permission checks and
+// mutations) drops entries without an absolute path: they can never grant
+// anything, and the replaced file survives as projects.json.bak.
+function normalizeStore(parsed, strict) {
+  const projects = Array.isArray(parsed?.projects) ? parsed.projects : [];
+  return {
+    projects: projects
+      .filter(
+        (entry) => entry && typeof entry.path === 'string' && entry.path.trim() && (!strict || isAbsolute(entry.path))
+      )
+      .map((entry) => ({
+        name: String(entry.name || basename(entry.path) || entry.path),
+        path: String(entry.path),
+        addedAt: Number(entry.addedAt) || 0,
+        ...(Number(entry.lastSelectedAt) > 0 ? { lastSelectedAt: Number(entry.lastSelectedAt) } : {}),
+      })),
+  };
+}
+
+// A damaged registry file (NUL, truncated, malformed) is kept aside as
+// projects.json.corrupt-<ts> and the last good projects.json.bak is restored
+// when there is one, else the registry starts empty: a damaged file never
+// blocks adding, removing or selecting a project. Strict callers still see a
+// real I/O failure (EACCES, EIO) as an error — an unreadable registry is not
+// an empty one; the tolerant listing reads it as empty.
 function readStore(strict = false) {
   try {
-    if (!strict && !existsSync(PROJECTS_FILE)) return { projects: [] };
-    const raw = readFileSync(PROJECTS_FILE, 'utf8');
-    const parsed = JSON.parse(raw);
-    if (
-      strict &&
-      (!Array.isArray(parsed?.projects) ||
-        parsed.projects.some(
-          (entry) => !entry || typeof entry.path !== 'string' || !entry.path.trim() || !isAbsolute(entry.path)
-        ))
-    )
-      throw new TypeError('Project registry is invalid.');
-    const projects = Array.isArray(parsed?.projects) ? parsed.projects : [];
-    return {
-      projects: projects
-        .filter((entry) => entry && typeof entry.path === 'string' && entry.path.trim())
-        .map((entry) => ({
-          name: String(entry.name || basename(entry.path) || entry.path),
-          path: String(entry.path),
-          addedAt: Number(entry.addedAt) || 0,
-          ...(Number(entry.lastSelectedAt) > 0 ? { lastSelectedAt: Number(entry.lastSelectedAt) } : {}),
-        })),
-    };
+    return normalizeStore(readJsonStateSync(PROJECTS_FILE), strict);
   } catch (error) {
-    if (strict && error?.code !== 'ENOENT') throw error;
+    if (strict) throw error;
     return { projects: [] };
   }
 }
 
 // Serialize the entire read/modify/write across cooperating processes, not
-// just publication. Unlike the generic JSON updater, a corrupt registry must
-// never be repaired into an empty document. Preserve synchronous return values
-// and no-op behavior; failed reads, lock acquisition and writes propagate.
+// just publication: the file is read under the registry lock. Preserve
+// synchronous return values and no-op behavior (an unchanged store is not
+// written); failed reads, lock acquisition and writes propagate. Each write
+// keeps the replaced version as projects.json.bak.
 function mutateStore(mutator) {
-  return withFileLockSync(`${PROJECTS_FILE}.lock`, () => {
-    const store = readStore(true);
-    const { value, changed } = mutator(store);
-    if (changed) writeJsonAtomicSync(PROJECTS_FILE, store, { lock: false });
-    return value;
-  });
+  let outcome;
+  updateJsonAtomicSync(
+    PROJECTS_FILE,
+    (current) => {
+      const store = normalizeStore(current, true);
+      outcome = mutator(store);
+      return outcome.changed ? store : undefined;
+    },
+    { backup: true }
+  );
+  return outcome.value;
 }
 
 /**
@@ -78,7 +88,8 @@ function mutateStore(mutator) {
  * selection store and memory project_id classification (resolveProjectId)
  * agree. Rules:
  *   - Never overwrite an existing marker (user may have set 'common' or a
- *     custom id — respect it).
+ *     custom id — respect it). A marker holding no data (empty or NUL, what a
+ *     crash leaves) is no id: it is rewritten.
  *   - Only act when absPath is a real directory on disk; never create the
  *     project folder itself (addProject does NOT create the directory).
  *   - Marker value = provided name, else basename(absPath). Skip when the
@@ -97,14 +108,12 @@ function ensureProjectIdMarker(absPath, name) {
       return; // missing / unstattable → silently skip
     }
     const markerPath = join(absPath, '.mixdog', 'project.id');
-    if (existsSync(markerPath)) return; // preserve existing value
+    const present = existsSync(markerPath);
+    if (present && !holdsNoData(readFileSync(markerPath))) return; // preserve existing value
     const value = String(name || basename(absPath) || '').trim();
     if (!value || value.toLowerCase() === 'common') return;
-    const markerDir = join(absPath, '.mixdog');
-    mkdirSync(markerDir, { recursive: true });
-    const tmp = `${markerPath}.${process.pid}.tmp`;
-    writeFileSync(tmp, `${value}\n`, 'utf8');
-    renameSync(tmp, markerPath);
+    // A missing marker is created only if still missing (a concurrent creator's wins).
+    writeFileAtomicSync(markerPath, `${value}\n`, { createOnly: !present });
   } catch {
     /* best-effort marker; never throw */
   }

package/src/runtime/shared/provider-accounts.mjs

@@ -1,7 +1,6 @@
 import { createHash, randomUUID } from 'node:crypto';
-import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { parseJsonText, updateJsonAtomic } from './atomic-file.mjs';
+import { readJsonStateSync, unsupportedState, updateJsonAtomic } from './atomic-file.mjs';
 import { resolvePluginData } from './plugin-paths.mjs';
 
 export const ACCOUNT_PROVIDERS = Object.freeze([
@@ -34,12 +33,19 @@ function requireAccountId(id) {
 
 function validate(raw) {
   if (raw == null) return { version: 1, providers: {} };
+  // A newer build's roster is left in place: reads see no accounts and writes
+  // refuse, so a downgrade never discards it.
+  if (Number.isSafeInteger(raw.version) && raw.version > 1) {
+    throw unsupportedState(`Provider account settings version ${raw.version} is newer than this build.`);
+  }
   if (raw.version !== 1 || !raw.providers || typeof raw.providers !== 'object') {
     throw new Error('Provider account settings are unreadable.');
   }
   for (const [provider, pool] of Object.entries(raw.providers)) {
-    requireAccountProvider(provider);
-    if (!Array.isArray(pool.accounts) || pool.accounts.length > MAX_ACCOUNTS) {
+    // A provider a newer build added is carried as is: this build never reads
+    // or writes its pool, and treating it as damage would discard it.
+    if (!ACCOUNT_PROVIDERS.includes(provider)) continue;
+    if (!Array.isArray(pool?.accounts) || pool.accounts.length > MAX_ACCOUNTS) {
       throw new Error('Invalid provider account list.');
     }
     const ids = pool.accounts.map((row) => requireAccountId(row.id));
@@ -48,13 +54,11 @@ function validate(raw) {
   return raw;
 }
 
+// Every OAuth provider's init reads the roster, so a damaged one (crash
+// leftovers, truncation, a shape this build rejects) must never throw: it is
+// kept aside and the last good copy, which every write keeps, is restored.
 function read(dataDir) {
-  try {
-    return validate(parseJsonText(readFileSync(file(dataDir), 'utf8')));
-  } catch (error) {
-    if (error.code === 'ENOENT') return validate(null);
-    throw error;
-  }
+  return readJsonStateSync(file(dataDir), { validate, fallback: validate(null), secret: true });
 }
 
 // Labels an earlier build assigned automatically. They read as a different
@@ -106,7 +110,8 @@ export function readProviderAccountPool(provider, dataDir = resolvePluginData())
 
 async function update(provider, mutate) {
   requireAccountProvider(provider);
-  // Read failures must not be interpreted as an empty account roster.
+  // A roster that parses yet fails validation is recovered here first; the
+  // mutator's validate would otherwise refuse every write. I/O failures throw.
   read();
   const result = await updateJsonAtomic(
     file(),
@@ -117,7 +122,7 @@ async function update(provider, mutate) {
       state.providers[provider] = pool;
       return validate(state);
     },
-    { mode: 0o600, secret: true, fsyncDir: true }
+    { mode: 0o600, secret: true, fsyncDir: true, backup: true }
   );
   return normalizePool(result.providers[provider]);
 }

package/src/runtime/shared/routine-trigger.d.mts

@@ -4,7 +4,12 @@ export interface RoutineTrigger {
   event?: string;
 }
 
-export declare function routineTriggerHeader(input: { kind: string; name: string; project?: string }): string;
+export declare function routineTriggerHeader(input: {
+  kind: string;
+  name: string;
+  project?: string;
+  now?: Date | number;
+}): string;
 export declare function stripRoutineTriggerHeader(text: unknown): string;
 export declare function normalizeRoutineTrigger(value: unknown): RoutineTrigger | null;
 export declare function routineTriggerField(value: unknown): { routineTrigger?: RoutineTrigger };

package/src/runtime/shared/routine-trigger.mjs

@@ -4,18 +4,26 @@
 // carries (live, persisted in meta.transcript, restored) so a chat paints it
 // as a routine marker instead of a user bubble.
 
+import { localTimestampParts } from './time-format.mjs';
+
 const HEADER_PREFIX = '[Routine trigger]';
 const KINDS = new Set(['schedule', 'webhook']);
 
-/** The first line of a routine turn's prompt: which routine fired and how to
- *  treat the turn. Only the turn's content carries it, never the system
- *  prompt, so the thread's prompt cache is untouched. */
-export function routineTriggerHeader({ kind, name, project = '' }) {
+/** The first line of a routine turn's prompt: which routine fired, when (local
+ *  time and zone: the turn gets no other date), and how to treat the turn.
+ *  It is the routine's only conduct text. Only the turn's content carries it,
+ *  never the system prompt, so the thread's prompt cache is untouched. */
+export function routineTriggerHeader({ kind, name, project = '', now = new Date() }) {
   const what = kind === 'webhook' ? 'webhook' : 'schedule';
+  const at = localTimestampParts(now);
   return [
     `${HEADER_PREFIX} Your ${what} "${String(name)}" fired.`,
-    'Carry out its instructions below now, yourself or by delegating; nobody is watching this turn, so approvals wait for the user.',
-    'Reply in this chat with the result.',
+    ...(at ? [`Local time: ${at.date} ${at.time.slice(0, 5)} ${at.timeZone} (${at.offset}).`] : []),
+    'Carry out its instructions below now, yourself or by delegating.',
+    'Nobody is watching this turn and nothing asks for approval: act within your permissions.',
+    'Payments and permanent deletes are refused here: report that and suggest doing it from the chat.',
+    'If a sign-in, code or CAPTCHA blocks you, stop and say which site needs the user.',
+    'Reply in this chat in plain words, without tool names; if you handed work off, say it started — its result arrives here later.',
     ...(project ? [`Project folder: ${project}`] : []),
   ].join(' ');
 }

package/src/runtime/shared/run-child.d.mts

@@ -0,0 +1,3 @@
+import type { ChildProcess } from 'node:child_process';
+
+export function killChildTree(child: ChildProcess): void;

package/src/runtime/shared/run-child.mjs

@@ -8,6 +8,29 @@
 // maxBytes, or the spawn error itself.
 import { spawn } from 'node:child_process';
 
+/** Kills `child` with everything it started. On Windows a plain kill ends only
+ *  the child itself: `git` there is a launcher whose git.exe (and the alias,
+ *  hook or filter it runs) would live on, still holding the output pipes. */
+export function killChildTree(child) {
+  if (process.platform === 'win32' && child.pid && child.exitCode === null) {
+    const taskkill = `${process.env.SystemRoot || 'C:\\Windows'}\\System32\\taskkill.exe`;
+    const fallback = () => {
+      try {
+        child.kill();
+      } catch {}
+    };
+    spawn(taskkill, ['/PID', String(child.pid), '/T', '/F'], { stdio: 'ignore', windowsHide: true })
+      .once('error', fallback)
+      .once('exit', (code) => {
+        if (code !== 0) fallback();
+      });
+    return;
+  }
+  try {
+    child.kill();
+  } catch {}
+}
+
 export function runChild({ command, args, cwd, input, env, timeoutMs, maxBytes, stdoutEncoding = 'utf8' }) {
   return new Promise((resolvePromise, rejectPromise) => {
     const hasInput = (typeof input === 'string' || ArrayBuffer.isView(input)) && input.length > 0;
@@ -35,9 +58,7 @@ export function runChild({ command, args, cwd, input, env, timeoutMs, maxBytes,
         ? setTimeout(() => {
             const error = new Error(`${command} ${args.join(' ')} timed out after ${timeoutMs}ms`);
             error.code = 'ETIMEDOUT';
-            try {
-              child.kill();
-            } catch {}
+            killChildTree(child);
             finish(error);
           }, timeoutMs)
         : null;

package/src/runtime/shared/session-baseline-store.mjs

@@ -809,8 +809,14 @@ export function _unsavedBytesForTest(sessionId) {
 async function readBlob(sessionId, entry) {
   if (!entry?.blob) return undefined;
   try {
-    const bytes = await readFile(join(blobDir(sessionId), entry.blob));
-    return digest(bytes) === entry.blob ? bytes : undefined;
+    const path = join(blobDir(sessionId), entry.blob);
+    const bytes = await readFile(path);
+    if (digest(bytes) === entry.blob) return bytes;
+    // A torn blob (unflushed write cut by a crash). Blobs are published whole
+    // and never replaced, so a mismatch is damage: drop it, or the create-only
+    // write of a later capture of the same content would skip over it.
+    await rm(path, { force: true });
+    return undefined;
   } catch {
     return undefined;
   }

package/src/runtime/shared/singleton-owner.mjs

@@ -1,6 +1,6 @@
-import { mkdirSync, renameSync, rmdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { rmdirSync, rmSync, statSync } from 'node:fs';
 import { readFile, rename, rm, rmdir, stat, writeFile } from 'node:fs/promises';
-import { dirname } from 'node:path';
+import { writeJsonAtomicSync } from './atomic-file.mjs';
 import { withFileLock, withFileLockSync } from './file-lock.mjs';
 import { readJsonSafe } from './json-file.mjs';
 import { isPidAlive } from './pid-liveness.mjs';
@@ -19,11 +19,12 @@ const CLAIM_LOCK_STALE_MS = 5000;
 const CLAIM_LOCK_OPTS = Object.freeze({ timeoutMs: CLAIM_LOCK_TIMEOUT_MS, staleMs: CLAIM_LOCK_STALE_MS });
 const BUSY = Symbol('claim lock busy');
 
+// A claim or handoff is flushed before it is published. The heartbeat's async
+// refresh below is not: it rewrites the record every few seconds, and a record
+// a crash leaves NUL reads as "no owner" (readJsonSafe), so the next claim
+// simply takes over.
 function writeJsonAtomic(path, value) {
-  mkdirSync(dirname(path), { recursive: true });
-  const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
-  writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`);
-  renameSync(tmp, path);
+  writeJsonAtomicSync(path, value);
 }
 
 // Held by another live process or this one's async holder ('busy'). Any other

package/src/runtime/shared/skill-tool-dependencies.mjs

@@ -1,8 +1,9 @@
 // Explicit skill dependencies. Imported manifests are read, never rewritten.
-import { createHash, randomUUID } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, rmSync, statSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { parseDocument } from 'yaml';
+import { writeFileAtomicSync } from './atomic-file.mjs';
 import { resolvePluginData } from './plugin-paths.mjs';
 
 const MAX_METADATA_BYTES = 64 * 1024;
@@ -119,12 +120,5 @@ export function saveSkillToolDependencies(filePath, dependencies) {
   const tools = normalizeSkillToolDependencies(dependencies, { strict: true });
   const content = `${JSON.stringify({ dependencies: { tools } }, null, 2)}\n`;
   if (Buffer.byteLength(content) > MAX_METADATA_BYTES) throw new Error('Skill dependency metadata is too large.');
-  mkdirSync(dirname(path), { recursive: true });
-  const temporary = `${path}.${randomUUID()}.tmp`;
-  try {
-    writeFileSync(temporary, content, { encoding: 'utf8', flag: 'wx' });
-    renameSync(temporary, path);
-  } finally {
-    rmSync(temporary, { force: true });
-  }
+  writeFileAtomicSync(path, content);
 }

package/src/runtime/shared/staged-update.mjs

@@ -50,7 +50,7 @@ import { resolvePluginData } from './plugin-paths.mjs';
 import { isPidAlive as pidAlive } from './pid-liveness.mjs';
 import { sleepSync } from './sleep.mjs';
 import { detachedSpawnOpts, hiddenSpawnOpts } from './spawn-flags.mjs';
-import { renameWithRetrySync } from './atomic-file.mjs';
+import { renameWithRetrySync, writeJsonAtomicSync } from './atomic-file.mjs';
 import {
   isDevInstall,
   localPackageVersion,
@@ -295,7 +295,9 @@ export async function runStagedInstall(version) {
 
     if (!existsSync(join(pkgDir, 'src', 'cli.mjs'))) return { ok: false, error: 'staged cli.mjs missing' };
     // Marker written LAST — its presence is the completion signal for the swap.
-    writeFileSync(markerPath(verDir), JSON.stringify({ version: v, pkgDir, stagedAt: Date.now() }), 'utf8');
+    // Published whole and flushed: a NUL marker would read as "not staged" and
+    // force a full re-install.
+    writeJsonAtomicSync(markerPath(verDir), { version: v, pkgDir, stagedAt: Date.now() }, { compact: true });
     return { ok: true, version: v, dir: pkgDir };
   } catch (err) {
     return { ok: false, error: err?.message || String(err) };

package/src/runtime/shared/statusline/statusline-segments.mjs

@@ -197,11 +197,11 @@ async function refreshShellJobsStatus(ownerPid) {
       }
       // A killed command whose processes are not confirmed gone has already
       // reported its result, so its tool card is closed: it is listed until
-      // its owner retires the record. Its root pid may be gone while a
-      // descendant lives, so the owner's liveness decides, not the root's.
+      // its owner retires the record. An incomplete observation can leave no
+      // known survivors even after the owner session closes; only the owning
+      // runtime can confirm termination, so its liveness decides, not the root's.
       const unconfirmed = detail?.terminationUnconfirmed === true;
-      if (unconfirmed ? !isHeldShellJobAlive(detail, ownerByJob.get(id)) : !(await isShellJobAlive(detail, p, dir, id)))
-        continue;
+      if (unconfirmed ? !isPidAlive(ownerByJob.get(id) || 0) : !(await isShellJobAlive(detail, p, dir, id))) continue;
       // A foreground command is awaited in its own tool card; listing it here
       // made every short command flash in and out of the shell list. Only
       // backgrounded jobs (including promoted ones) are background work.
@@ -327,17 +327,6 @@ function summarizeShellJobs({ count, oldestMs, jobs, bySession }) {
   return { count, elapsedLabel, jobs, sessions };
 }
 
-// A held record lives while its owner process does. Once its owner session
-// has closed, it also needs a process left to hold: the root or a survivor
-// its termination watch last reported. Without one it is an orphan whose
-// processes are gone, and it resolves instead of staying unconfirmed.
-function isHeldShellJobAlive(detail, ownerPid) {
-  if (!isPidAlive(ownerPid || 0)) return false;
-  if (detail?.ownerSessionClosed !== true) return true;
-  const survivors = Array.isArray(detail?.survivorPids) ? detail.survivorPids : [];
-  return [detail?.pid, ...survivors].some((pid) => isPidAlive(positiveInt(pid)));
-}
-
 async function isShellJobAlive(detail, detailPath, dir, id) {
   const pid = positiveInt(detail?.pid);
   if (!pid) return false;

package/src/runtime/shared/tool-execution-contract.mjs

@@ -236,6 +236,12 @@ export function isTranscriptHiddenToolItem(item) {
 // stopped, and the restored transcript must keep that row
 // (scripts/turn-checkpoint-crash-test.mjs).
 const INTERNAL_TRANSCRIPT_INTERRUPT_RE = /^\[request interrupted by user(?: for tool use)?\]$/i;
+// Every runtime control row written as a user turn when a turn is cut short
+// (including the bare "[Request interrupted]" a kept Stop prompt gets). One
+// pattern for "not real conversation": realTurnCount and the preview/title
+// noise filter both use it.
+export const CONTROL_MARKER_RE =
+  /^\[(?:truncated|request interrupted(?: by user(?: for tool use)?| by process restart)?)\]$/i;
 const TRANSCRIPT_CANCELLED_STATUS_RE = /^\[request interrupted(?: by process restart)?\]$/i;
 
 // Crash/implicit interruption markers remain in model-visible history for

package/src/runtime/shared/transcript-metadata.mjs

@@ -53,6 +53,20 @@ export function normalizeMessageAttachments(value) {
   return out;
 }
 
+/**
+ * Who a user-kind row came from, as the row's own fields: the sender, the
+ * submitting device and the bot that sent it. One definition for the delivered
+ * steering row and the still-queued one, so both render the same.
+ */
+export function transcriptSourceFields(value) {
+  if (!value || typeof value !== 'object') return {};
+  return {
+    ...(typeof value.sender === 'string' && value.sender ? { sender: value.sender } : {}),
+    ...(typeof value.device === 'string' && value.device ? { device: value.device } : {}),
+    ...(typeof value.fromAgent === 'string' && value.fromAgent ? { fromAgent: value.fromAgent } : {}),
+  };
+}
+
 /** A new stable message id (`meta.transcript.messageId`). */
 export function newTranscriptMessageId() {
   return `msg_${globalThis.crypto.randomUUID().replaceAll('-', '')}`;
@@ -71,14 +85,19 @@ export function persistedUserTranscriptMetadata(value) {
     ...(typeof value.attemptId === 'string' && value.attemptId ? { attemptId: value.attemptId } : {}),
     ...(Number.isFinite(Number(value.at)) ? { at: Number(value.at) } : {}),
     ...transcriptRouteMetadataFields(value),
-    ...(typeof value.sender === 'string' && value.sender ? { sender: value.sender } : {}),
-    // The device that submitted the prompt (host-stamped display name).
-    ...(typeof value.device === 'string' && value.device ? { device: value.device } : {}),
+    // Sender, the submitting device (host-stamped display name) and the bot
+    // that sent this message to this session (agent-task-sessions.mjs).
+    ...transcriptSourceFields(value),
+    // Bot-to-bot chain position of a bot's message (session-runtime/bot-hops.mjs).
+    ...(Number.isInteger(value.hop) && value.hop > 0 ? { hop: value.hop } : {}),
     // The turn's change-record key (the outer prompt id), so a restored user
     // row still addresses its turn's Undo/Reapply.
     ...(typeof value.checkpointId === 'string' && value.checkpointId ? { checkpointId: value.checkpointId } : {}),
     // Every submission a merged queued batch delivered as this turn.
     ...submissionIdsField(value.submissionIds),
+    // The executions a woken batch delivered (session-flow/drain.mjs): the
+    // provenance a task session's report follows (agent-task-sessions.mjs).
+    ...consumedExecutionIdsField(value.consumedExecutionIds),
     ...attachmentsField(value.attachments),
     // A routine fire delivered as this turn (routine-trigger.mjs).
     ...routineTriggerField(value),
@@ -90,6 +109,12 @@ function submissionIdsField(value) {
   return ids.length ? { submissionIds: ids } : {};
 }
 
+// Positions are kept: a null stands for a delivered entry that named no execution.
+function consumedExecutionIdsField(value) {
+  if (!Array.isArray(value) || !value.length) return {};
+  return { consumedExecutionIds: value.map((id) => (typeof id === 'string' && id ? id : null)) };
+}
+
 function attachmentsField(value) {
   const attachments = normalizeMessageAttachments(value);
   return attachments.length ? { attachments } : {};

package/src/runtime/shared/transcript-writer/session-record.mjs

@@ -3,8 +3,7 @@
  * record that names this session's transcript for discovery, plus the
  * first-occurrence failure logger every transcript writer shares.
  */
-import { mkdirSync, writeFileSync } from 'node:fs';
-import { dirname } from 'node:path';
+import { writeJsonAtomicSync } from '../atomic-file.mjs';
 
 // Repeated-failure guard: log the first time each distinct message is seen,
 // then stay quiet so a persistently-broken path does not flood stderr.
@@ -27,10 +26,11 @@ export function createSessionRecord({ sessionRecordPath, sessionId, resolvedCwd,
 
   function write() {
     try {
-      mkdirSync(dirname(sessionRecordPath), { recursive: true });
-      writeFileSync(
+      // Published whole and flushed: a discovery reader never meets a torn or
+      // NUL record, and every refresh rewrites it anyway.
+      writeJsonAtomicSync(
         sessionRecordPath,
-        JSON.stringify({
+        {
           sessionId,
           cwd: resolvedCwd,
           transcriptPath,
@@ -38,7 +38,8 @@ export function createSessionRecord({ sessionRecordPath, sessionId, resolvedCwd,
           updatedAt: Date.now(),
           kind: 'interactive',
           entrypoint: 'cli',
-        })
+        },
+        { compact: true }
       );
     } catch (err) {
       logOnce(err);

package/src/runtime/shared/turn-snapshot-store.mjs

@@ -13,8 +13,9 @@
 // list is what lets a SHARED worktree still revert: the baseline describes the
 // whole tree, but only these paths may be restored from it.
 import { createHash } from 'node:crypto';
-import { mkdir, readFile, readdir, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { mkdir, readFile, readdir, rm, stat } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
+import { writeFileAtomicAsync } from './atomic-file.mjs';
 import { cleanString as clean } from './clean.mjs';
 import { resolvePluginData } from './plugin-paths.mjs';
 
@@ -173,10 +174,10 @@ async function sweepRecords() {
   await sweepDirectory(recordRoot(), RECORD_TTL_MS, MAX_RECORD_FILES);
 }
 
+// Flushed before it is published: a crash must not leave a record that reads as
+// NUL (every reader below answers a damaged record as "no record").
 async function writeJsonAtomically(path, payload) {
-  const temporary = `${path}.${process.pid}.tmp`;
-  await writeFile(temporary, JSON.stringify(payload), 'utf8');
-  await rename(temporary, path);
+  await writeFileAtomicAsync(path, JSON.stringify(payload));
 }
 
 /**

package/src/runtime/shared/turn-snapshot.mjs

@@ -54,6 +54,7 @@ import {
   reviewSectionTruncated,
 } from './review-diff.mjs';
 import { PATCH_EDIT_MAX_BYTES } from './bounded-file-read.mjs';
+import { runGitOffThread } from './git-runner.mjs';
 import { cleanString as clean } from './clean.mjs';
 import { createLineDiffBudget, lineDiffHunks, unifiedHunksBody } from './bounded-line-diff.mjs';
 
@@ -1718,13 +1719,52 @@ export async function getTurnChanges(sessionId, options = {}) {
   let status = 'missing';
   if (ownerSessionId && turnChangesPending(ownerSessionId, checkpointId)) status = 'pending';
   else if (record) status = record.files?.length || record.outside?.length ? 'ready' : 'none';
-  return turnChangesReply({
+  const reply = turnChangesReply({
     status,
     checkpointId,
     record,
     patch: options?.patch === true,
     file: clean(options?.file) || null,
   });
+  return status === 'ready' ? withIgnoredChangeFiles(ownerSessionId, reply) : reply;
+}
+
+// The gitignored files of each answered record revision (build output a file
+// tool wrote): flagged `ignored` so a viewer can leave them out of its turn
+// previews. Asked of Git once per revision; bounded.
+const IGNORED_CHANGE_CACHE_LIMIT = 200;
+const _ignoredChangeFiles = new Map();
+
+async function ignoredChangePaths(key, root, paths) {
+  const cached = _ignoredChangeFiles.get(key);
+  if (cached) return cached;
+  let ignored = new Set();
+  try {
+    const result = await runGitOffThread(['check-ignore', '-z', '--stdin'], {
+      cwd: root,
+      input: `${paths.join('\0')}\0`,
+      timeoutMs: 10_000,
+      maxBytes: 4 * 1024 * 1024,
+    });
+    // 0: some are ignored, 1: none; anything else (no repository) flags none.
+    if (result.code === 0) ignored = new Set(result.stdout.split('\0').filter(Boolean));
+  } catch {
+    // No Git to ask: nothing is flagged.
+  }
+  _ignoredChangeFiles.set(key, ignored);
+  while (_ignoredChangeFiles.size > IGNORED_CHANGE_CACHE_LIMIT) {
+    _ignoredChangeFiles.delete(_ignoredChangeFiles.keys().next().value);
+  }
+  return ignored;
+}
+
+async function withIgnoredChangeFiles(ownerSessionId, reply) {
+  const paths = reply.files.map((file) => file.path).filter((path) => path && !isAbsolute(path));
+  if (!reply.root || paths.length === 0) return reply;
+  const key = `${ownerSessionId}\0${reply.checkpointId}\0${reply.revision}\0${reply.root}`;
+  const ignored = await ignoredChangePaths(key, reply.root, paths);
+  if (ignored.size === 0) return reply;
+  return { ...reply, files: reply.files.map((file) => (ignored.has(file.path) ? { ...file, ignored: true } : file)) };
 }
 
 function serializeChangeMutation(ownerSessionId, task) {
@@ -1871,11 +1911,13 @@ async function mutateTurnChanges(sessionId, checkpointIdValue, fileValue, revisi
       if (targets.length === 0) throw new Error(`this turn has no changes to be ${verb}`);
     }
     const updated = await mutateRecordFiles(ownerSessionId, record, targets, reverse);
-    return turnChangesReply({
+    const reply = turnChangesReply({
       status: updated ? 'ready' : 'missing',
       checkpointId,
       record: withUnknownChangeStates(ownerSessionId, updated),
     });
+    // The viewer caches this reply as it caches a read: the same `ignored` flags.
+    return updated ? withIgnoredChangeFiles(ownerSessionId, reply) : reply;
   });
 }