mixdog 1.3.1 → 1.3.3

package/src/runtime/agent/orchestrator/session/manager/ask-turn-prepare.mjs

@@ -20,6 +20,8 @@ import {
   snapshotPendingSetupNotice,
 } from './prompt-utils.mjs';
 import { snapshotPendingWorkflowNotice } from './workflow-switch-notice.mjs';
+import { snapshotPendingOrchestrationModeNotice } from './orchestration-mode-switch-notice.mjs';
+import { buildAgentListingNotice } from './agent-listing-notice.mjs';
 import { codexWireSendOpts } from './session-id.mjs';
 import { _tryBridgeExplicitPrefetch } from './prefetch-bridge.mjs';
 import { filterModelVisibleSessionMessages } from './message-sanitize.mjs';
@@ -149,6 +151,7 @@ export async function buildUserTurn({
   transcriptMeta,
   turnPromptSource,
   effortConfiguration,
+  currentAgents,
 }) {
   const explicitPrefetchResult = await _tryBridgeExplicitPrefetch(session, explicitPrefetch, turnSignal);
   let contextBlock = '';
@@ -184,8 +187,15 @@ export async function buildUserTurn({
   // A mid-conversation workflow switch: the prompt and tools were rebuilt
   // for the new workflow; this turn tells the model once.
   const workflowNotice = snapshotPendingWorkflowNotice(session);
+  // A mid-conversation orchestration mode switch, after the workflow notice
+  // so the mode it names wins over the one a workflow reminder carries.
+  const orchestrationModeNotice = snapshotPendingOrchestrationModeNotice(session);
+  // Agents enabled or switched off since the conversation was last told.
+  const agentListingNotice = buildAgentListingNotice(session, currentAgents);
   const reminderBlock = [
     workflowNotice?.content || '',
+    orchestrationModeNotice?.content || '',
+    agentListingNotice?.content || '',
     workspaceNotice?.content || '',
     setupNotice?.content || '',
     currentTimeBlock ? `<system-reminder>\n# Current Time\n${currentTimeBlock}\n</system-reminder>` : '',
@@ -200,6 +210,8 @@ export async function buildUserTurn({
     ...(transcriptMeta ? { transcript: transcriptMeta } : {}),
     ...(turnPromptSource || {}),
     ...(effortConfiguration ? { effortConfiguration } : {}),
+    // What its reminder told, read back by later turns (agent-listing-notice.mjs).
+    ...(agentListingNotice ? { agentListing: agentListingNotice.meta } : {}),
   };
   const userTurnMessage = withRuntimeUserContext(
     {
@@ -215,6 +227,8 @@ export async function buildUserTurn({
     deferredToolDelta,
     goalReminder,
     workflowNotice,
+    orchestrationModeNotice,
+    agentListingNotice,
     workspaceNotice,
     setupNotice,
     userTurnMessage,

package/src/runtime/agent/orchestrator/session/manager/ask-turn-settle.mjs

@@ -10,6 +10,7 @@ import { acknowledgePendingDeferredToolDelta } from '../../runtime-core/deferred
 import { acknowledgePendingGoalReminder } from '../../runtime-core/goal-reminder.mjs';
 import { acknowledgePendingSetupNotice, acknowledgePendingWorkspaceNotice } from './prompt-utils.mjs';
 import { acknowledgePendingWorkflowNotice } from './workflow-switch-notice.mjs';
+import { acknowledgePendingOrchestrationModeNotice } from './orchestration-mode-switch-notice.mjs';
 import {
   finalizePendingMessageDelivery,
   drainPendingMessages,
@@ -141,6 +142,9 @@ export async function commitAskTurn({ sessionId, opened, prepared, result, rawTr
     acknowledgePendingGoalReminder(session, prepared.goalReminder.revision);
   }
   if (prepared.workflowNotice) acknowledgePendingWorkflowNotice(session, prepared.workflowNotice.revision);
+  if (prepared.orchestrationModeNotice) {
+    acknowledgePendingOrchestrationModeNotice(session, prepared.orchestrationModeNotice.revision);
+  }
   if (prepared.workspaceNotice) {
     acknowledgePendingWorkspaceNotice(session, prepared.workspaceNotice.revision);
   }

package/src/runtime/agent/orchestrator/session/manager/ask-turn-steering-drain.mjs

@@ -59,6 +59,7 @@ export function createAskSteeringDrain({ sessionId, turn, askOpts }) {
               ids: group.ids,
               mode: group.mode,
               ...(group.execution ? { execution: group.execution } : {}),
+              ...(group.hop ? { transcriptMeta: { hop: group.hop } } : {}),
             });
           }
         } else {

package/src/runtime/agent/orchestrator/session/manager/compaction-runner.mjs

@@ -110,17 +110,12 @@ function withoutLegacyCompactFields(value) {
     delete next[key];
   return next;
 }
-// Handoff-summary timeout scales with transcript size (clear/manual path):
-// default max(60s, ~10s per 25k estimated message tokens) capped at 300s.
-// The summary may run on a slow reasoning model — the session's own model is
-// used whenever the maintenance route is unavailable — where even a small
-// transcript outlives the old 30s floor and a large one the old 120s cap.
-// session.compaction.timeoutMs still overrides.
-function handoffSummaryTimeoutMs(session, messageTokens) {
-  const override = positiveInt(session?.compaction?.timeoutMs);
-  if (override) return override;
-  const scaled = Math.ceil((messageTokens || 0) / 25_000) * 10_000;
-  return Math.min(HANDOFF_TIMEOUT_MAX_MS, Math.max(60_000, scaled));
+// Handoff-summary timeout (clear/manual path): the same 300s as automatic
+// compaction, whatever the transcript size — the summary may run on a slow
+// reasoning model or a stalled provider connection, and a timeout fails the
+// compaction. session.compaction.timeoutMs still overrides.
+function handoffSummaryTimeoutMs(session) {
+  return positiveInt(session?.compaction?.timeoutMs) || HANDOFF_TIMEOUT_MAX_MS;
 }
 /**
  * ONE wiring for the fresh-context handoff pass: provider, summary model,
@@ -144,13 +139,8 @@ export async function runHandoffCompaction({
   provider = null,
   model = null,
   config,
-  messageTokensEst = null,
   requireReduction = false,
 } = {}) {
-  const messageList = Array.isArray(messages) ? messages : [];
-  const transcriptTokens = Number.isFinite(Number(messageTokensEst))
-    ? Number(messageTokensEst)
-    : estimateMessagesTokens(messageList);
   return runFreshContextCompact({
     sessionRef: session,
     messages,
@@ -159,7 +149,7 @@ export async function runHandoffCompaction({
       reserveTokens,
       contextWindow: positiveInt(contextWindow) || positiveInt(session?.contextWindow) || boundaryTokens,
       boundaryTokens,
-      handoffTimeoutMs: handoffSummaryTimeoutMs(session, transcriptTokens),
+      handoffTimeoutMs: handoffSummaryTimeoutMs(session),
     },
     sessionId,
     signal,
@@ -336,7 +326,6 @@ async function runSessionHandoff(plan, opts) {
       provider: opts.provider || getProvider(session.provider) || null,
       model: opts.model,
       config: opts.config,
-      messageTokensEst: plan.beforeMessageTokens,
       requireReduction: plan.requireReduction,
     });
     if (Array.isArray(run.freshContextResult?.messages)) {
@@ -609,7 +598,43 @@ function withAppendedMessages(plan, numbers, appended) {
 const TRANSCRIPT_MOVED_ERROR =
   'compact: the conversation changed while compacting; compaction not applied, run it again';
 
+// Why a compaction took as long as it did: persisted next to lastSummaryModel
+// and echoed as one daemon.log line. Wall time runs start → end of commit; the
+// summary call's own time comes from the handoff pipeline, so the remainder is
+// planning, transcript comparison and the commit below. The archive write is
+// scheduled by the commit and runs later, off it.
+function recordCompactionTiming(plan, freshContextResult, { startedAt, commitStartedAt, afterTokens }) {
+  const { session, resolvedSessionId } = plan;
+  const committedAt = Date.now();
+  const pipeline = freshContextResult?.diagnostics?.pipeline;
+  const summaryMs = pipeline?.generated?.durationMs ?? null;
+  // How the summary ran: a fork of the cached request or the isolated
+  // request, and on which route (session / maintenance / lighter).
+  let summaryRun = null;
+  if (pipeline?.summaryRoute) {
+    const kind = pipeline.generated?.mode === 'shared-prefix' ? 'fork' : 'isolated';
+    summaryRun = `${kind}:${pipeline.summaryRoute}`;
+  }
+  const timing = {
+    lastStartedAt: startedAt,
+    lastCommittedAt: committedAt,
+    lastDurationMs: committedAt - startedAt,
+    lastPipelineMs: pipeline?.totalMs ?? null,
+    lastSummaryMs: summaryMs,
+    lastCommitMs: committedAt - commitStartedAt,
+    lastCompactMode: summaryRun ? `${pipeline.mode}:${summaryRun}` : pipeline?.mode || null,
+  };
+  Object.assign(session.compaction, timing);
+  writeStderrBestEffort(
+    `compaction session=${resolvedSessionId || 'unknown'} source=${freshContextResult?.handoffSource || 'session-local'} ` +
+      `model=${freshContextResult?.summaryModel || '-'} mode=${summaryRun || '-'} total=${timing.lastDurationMs}ms ` +
+      `summary=${summaryMs ?? 0}ms commit=${timing.lastCommitMs}ms ` +
+      `in=${plan.beforeTokens} out=${afterTokens}\n`
+  );
+}
+
 async function commitSessionCompaction(plan, run, compactStartedAt) {
+  const commitStartedAt = Date.now();
   const { session, messages, mode, force, resolvedSessionId, reserveTokens } = plan;
   const { freshContextResult } = run;
   const numbers = await afterCompactionNumbers(plan, run.compacted);
@@ -688,6 +713,7 @@ async function commitSessionCompaction(plan, run, compactStartedAt) {
   if (changed) {
     session.pendingCacheBreakIntent = mode === 'auto' ? 'post_turn_compaction' : 'manual_compaction';
   }
+  recordCompactionTiming(plan, freshContextResult, { startedAt: compactStartedAt, commitStartedAt, afterTokens });
   return compactionResult(
     plan,
     { changed, reason: unchangedReason },

package/src/runtime/agent/orchestrator/session/manager/idle-cleanup.mjs

@@ -2,8 +2,14 @@
 // Periodic idle-session + tombstone sweep.
 // Drives sweepStaleSessions on an unref'd interval; closeSession is imported
 // from session-close.mjs (one-way dependency, no cycle).
-import { sweepStaleSessions, sweepStaleSessionsCooperative, evictIdleLiveSessions } from '../store.mjs';
+import {
+  applySubAgentRetention,
+  sweepStaleSessions,
+  sweepStaleSessionsCooperative,
+  evictIdleLiveSessions,
+} from '../store.mjs';
 import { sweepOrphanedPendingMessages } from './pending-messages.mjs';
+import { applySessionSidebarChange, readSessionSidebarState } from '../../../../shared/session-sidebar-host.mjs';
 import {
   IN_FLIGHT_STAGES,
   _getRuntimeEntry,
@@ -83,6 +89,29 @@ function _logTombstoneSweep(tombstonesCleaned, tombstoneDetails, tombstoneErrors
   }
 }
 
+// Sub-agent trees the sweep found idle: archived after 3 days (through the
+// desktop's archive flag, when one is attached), deleted after 30
+// (store/sweep/sub-agent-retention.mjs).
+async function _retainSubAgents(members) {
+  if (!members?.length) return;
+  try {
+    const flags = await readSessionSidebarState();
+    const applied = await applySubAgentRetention(members, {
+      isSessionLive: _isSessionLive,
+      isArchived: flags && ((id) => Object.hasOwn(flags.archived, id)),
+      setSidebar: applySessionSidebarChange,
+    });
+    for (const id of applied.deleted) if (!_isSessionLive(id)) _clearSessionRuntime(id);
+    if (applied.archived.length || applied.deleted.length) {
+      _sweepLog(
+        `[session-sweep] sub-agent retention: archived ${applied.archived.length}${_previewIds(applied.archived.map((id) => ({ id })))}, deleted ${applied.deleted.length}${_previewIds(applied.deleted.map((id) => ({ id })))}\n`
+      );
+    }
+  } catch (e) {
+    process.stderr.write(`[session-sweep] sub-agent retention error: ${e?.message || e}\n`);
+  }
+}
+
 async function sweepIdleSessions({ includeTombstones = true, sweepIdle = true } = {}) {
   const startedAt = Date.now();
   try {
@@ -90,8 +119,10 @@ async function sweepIdleSessions({ includeTombstones = true, sweepIdle = true }
       sweepIdle,
       tombstoneMaxAgeMs: includeTombstones ? TOMBSTONE_MAX_AGE_MS : 0,
       isSessionLive: _isSessionLive,
+      retainSubAgents: sweepIdle,
     });
     const { cleaned, remaining, details, tombstonesCleaned = 0, tombstoneDetails = [], tombstoneErrors = [] } = result;
+    await _retainSubAgents(result.subAgents);
     if (cleaned > 0) {
       for (const d of details) {
         if (!_finalizeSweptSessionRuntime(d)) continue;

package/src/runtime/agent/orchestrator/session/manager/orchestration-mode-switch-notice.mjs

@@ -0,0 +1,115 @@
+// manager/orchestration-mode-switch-notice.mjs
+// A mid-conversation delegation (orchestration) mode switch
+// (session-runtime/tool-policy-refresh.mjs switchSessionOrchestrationMode),
+// on the workflow switch's pattern (workflow-switch-notice.mjs): the request
+// prefix — system blocks and tool schemas — stays byte-identical, so the
+// provider cache survives. The switch lives in two pieces of session state:
+//   session.orchestrationModeOverlay — while the session's mode differs from
+//     the one its system prompt carries: the prompt's mode (`prompt`), the
+//     new mode, the tools the model must load before using them
+//     (`loadableTools`) and the self-contained reminder (`content`) with the
+//     new mode's rules (the same block BP3 carries). It is folded into the
+//     prompt (and dropped) at the next point where the cache is cold anyway.
+//   session.orchestrationModeSwitch — the notice the next user turn carries
+//     in its reminder block: snapshot when the turn is built, acknowledge once
+//     the provider accepted it. `from` is the mode the model was last told
+//     about, `to` the session's mode now.
+// Every notice says it replaces the earlier ones, so the latest one wins.
+import { normalizeOrchestrationMode, ORCHESTRATION_MODES } from '../../../../shared/orchestration.mjs';
+import { orchestrationInstructions } from '../../runtime-core/orchestration.mjs';
+
+/** The mode's name as its BP3 block titles it (`# Orchestration Mode: …`). */
+export function orchestrationModeName(value) {
+  const mode = normalizeOrchestrationMode(value);
+  return mode === 'none' ? 'Solo' : `${mode[0].toUpperCase()}${mode.slice(1)}`;
+}
+
+/** The mode the session's system prompt and tool surface were built with. */
+export function promptOrchestrationModeOf(session) {
+  if (session?.workflowOverlay) return session.workflowOverlay.promptOrchestrationMode;
+  if (session?.orchestrationModeOverlay) return session.orchestrationModeOverlay.prompt;
+  return session?.orchestrationMode;
+}
+
+/**
+ * Read a shipped coding-mode slice from the actual BP3 message, not the mode
+ * metadata: older profile refreshes could rewrite one without the other.
+ * Only a complete, unambiguous generated slice is evidence. Custom rules,
+ * headings quoted in another slice, and unrecognized legacy layouts are not.
+ */
+export function orchestrationModeFromPrompt(session) {
+  const core = session?.messages?.find(
+    (message) => message?.role === 'system' && message.cacheTier === 'tier3'
+  )?.content;
+  if (typeof core !== 'string') return null;
+  const slices = core.split('\n\n---\n\n');
+  const modes = ORCHESTRATION_MODES.filter((mode) => slices.includes(orchestrationInstructions(mode)));
+  return modes.length === 1 ? modes[0] : null;
+}
+
+const listed = (names) => names.map((name) => `\`${name}\``).join(', ');
+
+/** The reminder that makes the Lead follow `mode`: self-contained (the mode's
+ *  rules) and superseding every earlier one. `carried`: the system prompt
+ *  carries this mode itself (a switch back, or the overlay folded in). */
+export function orchestrationModeNoticeContent({ mode, carried = false, loadableTools = [] }) {
+  const name = orchestrationModeName(mode);
+  const lead = carried
+    ? `This conversation now uses the ${name} orchestration mode, the one the system prompt carries.`
+    : `This conversation now uses the ${name} orchestration mode. The system prompt's Orchestration Mode no longer applies; follow ${name}'s below instead.`;
+  const pronoun = loadableTools.length === 1 ? 'it' : 'them';
+  return [
+    '<system-reminder>',
+    '# Orchestration Mode Changed',
+    `${lead} This replaces every earlier Orchestration Mode Changed reminder in this conversation.`,
+    ...(loadableTools.length
+      ? [
+          `${listed(loadableTools)}: not among your directly defined tools yet; load ${pronoun} with \`load_tool\` before the first call.`,
+        ]
+      : []),
+    `Agents already started keep running with their own instructions; new delegation follows ${name}.`,
+    '',
+    orchestrationInstructions(mode),
+    '</system-reminder>',
+  ].join('\n');
+}
+
+/** Stage the notice of a switch from `from` to `to`; a switch back to what the
+ *  model was last told drops it. Returns the staged state or null. */
+export function stageOrchestrationModeSwitchNotice(session, from, to) {
+  const prior = session.orchestrationModeSwitch;
+  const told = prior ? prior.from : from;
+  if (!to || told === to) {
+    delete session.orchestrationModeSwitch;
+    return null;
+  }
+  session.orchestrationModeSwitch = {
+    version: 1,
+    revision: (Number(prior?.revision) || 0) + 1,
+    from: told,
+    to,
+  };
+  return session.orchestrationModeSwitch;
+}
+
+/**
+ * The orchestration mode notice the next user turn carries, or null.
+ * @returns {{ revision: number, content: string } | null}
+ */
+export function snapshotPendingOrchestrationModeNotice(session) {
+  const pending = session?.orchestrationModeSwitch;
+  if (!pending?.to) return null;
+  const overlay = session.orchestrationModeOverlay;
+  const content =
+    overlay?.mode === pending.to && overlay.content
+      ? overlay.content
+      : orchestrationModeNoticeContent({ mode: pending.to, carried: true });
+  return { revision: pending.revision, content };
+}
+
+/** The notice of `revision` reached the model: nothing is due any more. */
+export function acknowledgePendingOrchestrationModeNotice(session, revision) {
+  if (!session?.orchestrationModeSwitch || session.orchestrationModeSwitch.revision !== Number(revision)) return false;
+  delete session.orchestrationModeSwitch;
+  return true;
+}

package/src/runtime/agent/orchestrator/session/manager/owner-route-fallbacks.mjs

@@ -0,0 +1,42 @@
+// The fallback models a Lead-class session starts with. Agents get theirs from
+// their spawn preset (agent-child.mjs); a Lead-class session gets its OWNER's:
+// - a coding Lead (new task, task a bot created): the Lead route, i.e. the
+//   preset of `config.default` (workflow-lead);
+// - an agent-mode Lead (a bot's home chat, a room turn, a routine run, or
+//   Mixy's own thread): that bot's own route in its folder (agent.json), so
+//   Mixy and the Lead keep separate chains.
+// The chain applies only while the session runs on the owner's configured
+// primary model. A session the user put on another model (composer picker,
+// New Task) is a deliberate choice and gets none. Route changes recompute it
+// (updateSessionRoute `routeFallbacks`); a fallback hop does not.
+import { loadConfig } from '../../config.mjs';
+import { findPreset } from '../../runtime-core/config-helpers.mjs';
+import { normalizeWorkflowRoute } from '../../runtime-core/workflow.mjs';
+import { canonicalRouteProvider } from '../../../../shared/model-route-chain.mjs';
+import { storedBotRoute } from '../../../../shared/agent-store.mjs';
+import { configuredAgentRouteCandidates } from '../../../../shared/agent-route-config.mjs';
+import { CODING_MODE } from '../agent-mode.mjs';
+
+export function ownerRouteFallbacks({ sessionMode, agentId, provider, model, config = null }) {
+  if (!agentId) return [];
+  const cfg = () => config || loadConfig({ secrets: false });
+  let stored;
+  if (sessionMode === CODING_MODE) {
+    stored = findPreset(cfg(), cfg()?.default);
+  } else {
+    // Before the bot split a bot's route is still in the config (Mixy's never).
+    stored = storedBotRoute(agentId) || (agentId === 'lead' ? null : configuredAgentRouteCandidates(cfg(), agentId)[0]);
+  }
+  if (!stored?.fallbacks?.length) return [];
+  let route;
+  try {
+    route = normalizeWorkflowRoute(stored);
+  } catch {
+    return [];
+  }
+  const onPrimary =
+    route &&
+    canonicalRouteProvider(route.provider) === canonicalRouteProvider(provider) &&
+    String(route.model) === String(model);
+  return onPrimary ? route.fallbacks || [] : [];
+}

package/src/runtime/agent/orchestrator/session/manager/pending-message-entry.mjs

@@ -3,6 +3,7 @@ import { mergeNormalizedContentEntries } from '../loop/steering.mjs';
 import { isDeliveredCompletion, logDuplicateSkip } from './delivered-completions.mjs';
 import { promptContentText } from './prompt-utils.mjs';
 import { parseTaskNotification, taskNotificationId } from '../../../../shared/task-notification-envelope.mjs';
+import { hopOf } from '../../../../shared/bot-hops.mjs';
 
 const STALE_USER_INJECTION_TTL_MS = 30 * 60 * 1000;
 const PENDING_PROCESS_START_MS = Date.now();
@@ -95,11 +96,13 @@ function executionFromCompletionMeta(meta) {
 function completionEntryFields(entry) {
   const executionId = completionExecutionId(entry);
   const execution = normalizeExecution(entry?.execution, executionId);
+  const hop = hopOf(entry?.hop);
   return {
     notificationKind: COMPLETION_NOTIFICATION_KIND,
     mode: PENDING_MODE_TASK_NOTIFICATION,
     ...(executionId ? { executionId } : {}),
     ...(execution ? { execution } : {}),
+    ...(hop ? { hop } : {}),
   };
 }
 
@@ -141,6 +144,8 @@ export function markCompletionEntry(text, options = {}) {
     mode: PENDING_MODE_TASK_NOTIFICATION,
     ...(executionId ? { executionId } : {}),
     ...(execution ? { execution } : {}),
+    // The bot-chain hop of the turn that launched the work (bot-hops.mjs).
+    ...(hopOf(options?.meta?.hop) ? { hop: options.meta.hop } : {}),
     enqueuedAt: Date.now(),
   };
 }
@@ -337,6 +342,7 @@ export function _groupPendingMessageEntries(entries) {
       ...merged,
       mode: PENDING_MODE_TASK_NOTIFICATION,
       ...(normalized.execution ? { execution: normalized.execution } : {}),
+      ...(normalized.hop ? { hop: normalized.hop } : {}),
       ids: idsOf([entry]),
       entries: [entry],
     });

package/src/runtime/agent/orchestrator/session/manager/pending-messages.mjs

@@ -1,5 +1,5 @@
 // Steering / pending-message queue with sync buffering and atomic persistence.
-import { readFileSync } from 'node:fs';
+import { readJsonStateSync } from '../../../../shared/atomic-file.mjs';
 import { loadSession } from '../store.mjs';
 import {
   currentPendingLifecycleToken,
@@ -602,14 +602,8 @@ export function _getPendingMessagesForSession(sessionId) {
   const queued = [...(_sessionPendingMessages.get(sessionId) || []), ...(_pendingPersistBuffers.get(sessionId) || [])];
   // The not-yet-migrated global spool can still hold this session's rows.
   for (const path of [pendingMessagesPath(sessionId), legacyPendingMessagesPath()]) {
-    let raw;
-    try {
-      raw = readFileSync(path, 'utf8');
-    } catch (err) {
-      if (err?.code === 'ENOENT') continue;
-      throw err;
-    }
-    const persisted = normalizePendingStore(JSON.parse(raw)).sessions[sessionId];
+    // A damaged spool file is kept aside and reads as empty; it never throws.
+    const persisted = normalizePendingStore(readJsonStateSync(path, { fallback: null })).sessions[sessionId];
     if (Array.isArray(persisted)) queued.push(...persisted);
   }
   return queued;

package/src/runtime/agent/orchestrator/session/manager/pending-spool-file.mjs

@@ -17,7 +17,7 @@ export const _pendingPersistTails = new Map();
 export { pendingMessagesPath, touchPendingSessionEntry } from './pending-spool-path.mjs';
 
 // Single spool transaction shape: every mutation touches only `sessionId`'s
-// own shard file, locked, compact and non-fsync; `extra` only ever relaxes the
+// own shard file, locked, compact and durable; `extra` only ever relaxes the
 // lock timeout.
 export function updateSpool(sessionId, mutate, extra = null) {
   return updatePendingShard(sessionId, mutate, extra);

package/src/runtime/agent/orchestrator/session/manager/pending-spool-shard.mjs

@@ -21,7 +21,8 @@ function storeIsEmpty(store) {
   );
 }
 
-// One shard transaction: locked, compact, non-fsync. A shard emptied by the
+// One shard transaction: locked, compact, durable (queued user messages must
+// survive a crash; a damaged shard is kept aside by updateJsonAtomic). A shard emptied by the
 // mutation (or found empty) is deleted under the same lock, so the directory
 // holds only sessions that actually have queued rows.
 async function updateShardFile(key, mutate, extra = null) {
@@ -33,7 +34,6 @@ async function updateShardFile(key, mutate, extra = null) {
         compact: true,
         lock: true,
         mode: PENDING_MESSAGES_MODE,
-        fsync: false,
         ...extra,
       });
       if (storeIsEmpty(result)) {
@@ -50,7 +50,9 @@ async function updateShardFile(key, mutate, extra = null) {
 }
 
 function rowKey(row) {
-  return row && typeof row === 'object' && typeof row.id === 'string' && row.id ? `id:${row.id}` : `json:${JSON.stringify(row)}`;
+  return row && typeof row === 'object' && typeof row.id === 'string' && row.id
+    ? `id:${row.id}`
+    : `json:${JSON.stringify(row)}`;
 }
 
 // Idempotent merge of one legacy bucket into its shard: legacy rows (older)

package/src/runtime/agent/orchestrator/session/manager/prompt-utils.mjs

@@ -329,6 +329,42 @@ export function withPresentedWorkspaceSlices(session, nextHead) {
   return [nextHead, instructionFiles, memory].filter((part) => part?.trim()).join(BP3_PART_SEPARATOR);
 }
 
+const AGENT_CATALOG_HEADING = '# Available Agents';
+// One generated catalog line (workflow/context.mjs agentCatalog):
+// `- <name> (<id>)` with an optional `: <description>`.
+const AGENT_CATALOG_ENTRY = /^- (.+?) \(([^()\s]+)\)(?:: .*)?$/;
+
+/** The entries of a generated agent list slice, or null when `slice` is not
+ *  one (only the exact generated format is evidence). */
+export function agentListEntries(slice) {
+  const text = String(slice || '').trim();
+  if (!text.startsWith(`${AGENT_CATALOG_HEADING}\n\n`)) return null;
+  const entries = [];
+  for (const line of text.slice(AGENT_CATALOG_HEADING.length + 2).split('\n')) {
+    const match = AGENT_CATALOG_ENTRY.exec(line);
+    if (!match) return null;
+    entries.push({ id: match[2], name: match[1], line });
+  }
+  return entries;
+}
+
+/**
+ * The "# Available Agents" slice the session's prompt presents: '' when it
+ * carries none, null when what it carries under that heading is not one
+ * complete generated list (custom text, or more than one). A coding Lead's
+ * rebuilt core keeps a presented list, as it keeps the workspace slices: the
+ * list the model saw first stays the baseline every later agent list
+ * reminder applies to (agent-listing-notice.mjs).
+ */
+export function presentedAgentCatalogSlice(session) {
+  const core = session.bp3EnvSplit === true ? textOf(bp3SystemMessage(session)) : String(session.bp3CoreContext || '');
+  const slices = core
+    .split(BP3_PART_SEPARATOR)
+    .filter((slice) => slice === AGENT_CATALOG_HEADING || slice.startsWith(`${AGENT_CATALOG_HEADING}\n`));
+  if (!slices.length) return '';
+  return slices.length === 1 && agentListEntries(slices[0]) ? slices[0] : null;
+}
+
 const WORKSPACE_SLICES = ['environmentContext', 'coreMemoryContext', 'instructionFilesContext'];
 
 /**

package/src/runtime/agent/orchestrator/session/manager/rules-cache.mjs

@@ -1,9 +1,15 @@
 // Prompt-layer rules builders. Source revision tracking lives separately so
 // every layer observes deletions, replacements and timestamp rollbacks alike.
+import { createHash } from 'node:crypto';
 import { createRequire } from 'node:module';
 import { join } from 'node:path';
 import { resolvePluginData, mixdogRoot } from '../../../../shared/plugin-paths.mjs';
 import { createRulesSourceCache } from './rules-source-cache.mjs';
+import {
+  AGENT_MODE_DELEGATION,
+  MIXY_CONTACTS_INTRO,
+  orchestrationInstructions,
+} from '../../runtime-core/orchestration.mjs';
 
 // Phase B: Pool B Tier 2 content builder (common rules only).
 // Loaded once per process via createRequire so the CJS module reaches us.
@@ -129,7 +135,7 @@ export function _buildLeadRules({ includeLeadBrief = true, part = 'common' } = {
   );
 }
 
-// One agent-mode rule file (rules/agent-mode): 'conduct', 'mixy' or 'routine'.
+// One agent-mode rule file (rules/agent-mode): 'conduct' or 'mixy'.
 export function _buildAgentModeRules({ part = 'conduct' } = {}) {
   const PLUGIN_ROOT = mixdogRoot();
   return buildCachedRules(
@@ -141,6 +147,30 @@ export function _buildAgentModeRules({ part = 'conduct' } = {}) {
   );
 }
 
+// --- Rules revision ---
+// The shipped rule texts a bot thread's prompt embeds — the shared tool
+// policy (canonical variant), every LEAD.md part, the agent-mode files and
+// the orchestration/delegation texts — as one hash. A bot thread stamps it
+// at creation; another value (a release changed a rule) rebuilds its prompt
+// once (session-runtime/tool-policy-refresh.mjs). Built from the cached
+// builders, so a check costs a few stats.
+export function promptRulesRevision() {
+  const hash = createHash('sha256');
+  const texts = [
+    _buildSharedRules(),
+    ...['common', 'coding', 'agent', 'identity'].flatMap((part) =>
+      [true, false].map((includeLeadBrief) => _buildLeadRules({ includeLeadBrief, part }))
+    ),
+    _buildAgentModeRules({ part: 'conduct' }),
+    _buildAgentModeRules({ part: 'mixy' }),
+    AGENT_MODE_DELEGATION,
+    MIXY_CONTACTS_INTRO,
+    ...['none', 'focused', 'balanced', 'swarm'].map(orchestrationInstructions),
+  ];
+  for (const text of texts) hash.update(`${text}\0`);
+  return hash.digest('hex').slice(0, 24);
+}
+
 export function _buildLeadMetaContext({ includeOutputStyle = true } = {}) {
   const PLUGIN_ROOT = mixdogRoot();
   const DATA_DIR = resolvePluginData();
@@ -162,6 +192,15 @@ export function _buildLeadMetaContext({ includeOutputStyle = true } = {}) {
 // Trailing BP3 block: the configured response language. Kept out of BP2 so
 // it is the last instruction before the conversation (see
 // rules-builder.cjs buildLeadLanguageContent).
+// The configured response language as {id, name}, or null (a rule's `language`
+// condition compares the id; its text's {language} is the name).
+export function _buildLeadLanguage() {
+  const DATA_DIR = resolvePluginData();
+  return buildCachedRules('buildLeadLanguage', 'lead language', [join(DATA_DIR, 'mixdog-config.json')], {
+    DATA_DIR,
+  });
+}
+
 export function _buildLeadLanguageContext() {
   const DATA_DIR = resolvePluginData();
   return buildCachedRules('buildLeadLanguageContent', 'lead language context', [join(DATA_DIR, 'mixdog-config.json')], {

package/src/runtime/agent/orchestrator/session/manager/runtime-liveness.mjs

@@ -298,6 +298,16 @@ export function markSessionToolOutputTail(id, tail) {
   entry.toolOutputTail = text ? text.slice(-4000) : null;
   entry.toolOutputTailAt = Date.now();
 }
+// An approval has no wait limit, and the progress watchdog treats a turn with
+// `awaitingUser` as waiting on the user, not stalled. The user's answer is
+// progress: a wait begins and ends with a fresh progress stamp, so the hours
+// spent waiting are never counted as silence once the turn runs again.
+function _stampApprovalProgress(entry) {
+  if (entry.closed || entry.controller?.signal?.aborted || TERMINAL_STAGES.has(entry.stage)) return;
+  const now = Date.now();
+  entry.lastProgressAt = now;
+  entry.updatedAt = now;
+}
 // A turn blocked on the user: a PreToolUse `ask` waiting for the tool
 // approval only the user can give. Published as `awaitingUser: 'approval'` so
 // status surfaces stop presenting the session as working. Counted, because one
@@ -309,6 +319,7 @@ export function beginSessionApprovalWait(id) {
   if (!entry) return () => {};
   entry.approvalWaits = (entry.approvalWaits || 0) + 1;
   entry.awaitingUser = 'approval';
+  _stampApprovalProgress(entry);
   // The waiting turn: the end transition carries the begin's turn even when
   // the turn has settled (askStartedAt cleared) by the time it releases.
   const meta = { turnAt: entry.askStartedAt || 0 };
@@ -321,6 +332,7 @@ export function beginSessionApprovalWait(id) {
     entry.approvalWaits = Math.max(0, (entry.approvalWaits || 0) - 1);
     if (entry.approvalWaits > 0) return;
     entry.awaitingUser = null;
+    _stampApprovalProgress(entry);
     emitSessionApprovalWaitChange(id, null, meta);
   };
 }