mixdog 1.3.1 → 1.3.3

package/src/runtime/agent/orchestrator/session/manager/runtime-state.mjs

@@ -19,6 +19,25 @@ export function isTurnInFlight(entry) {
   return IN_FLIGHT_STAGES.has(entry.stage);
 }
 
+// Sessions whose turn was handed to the runtime but has not claimed its
+// controller yet (spawn dispatched, askSession still loading the session).
+// The row already declares work; without this the pool cannot tell that
+// first-turn gap from a worker it lost track of, and reads `unknown`.
+const dispatchedTurns = new Map();
+
+/** Runs `run` (the turn's dispatch) with `id` counted as working until it
+ *  settles, covering the gap before the turn's own runtime entry is in flight. */
+export async function whileTurnDispatched(id, run) {
+  dispatchedTurns.set(id, (dispatchedTurns.get(id) || 0) + 1);
+  try {
+    return await run();
+  } finally {
+    const left = dispatchedTurns.get(id) - 1;
+    if (left > 0) dispatchedTurns.set(id, left);
+    else dispatchedTurns.delete(id);
+  }
+}
+
 const cleanLower = (value) =>
   String(value || '')
     .trim()
@@ -32,6 +51,7 @@ const cleanLower = (value) =>
 export function inFlightSessionActivity() {
   const working = new Set();
   const agentWorking = new Set();
+  for (const id of dispatchedTurns.keys()) working.add(id);
   for (const [id, entry] of runtimeState) {
     if (!isTurnInFlight(entry)) continue;
     working.add(id);

package/src/runtime/agent/orchestrator/session/manager/session-crud.mjs

@@ -1,6 +1,7 @@
 // manager/session-crud.mjs
 // Session read + mutate CRUD: lookup (getSession/listSessions/findSessionByScopeKey),
 // message clear (with clear-fork), manual compaction, status update, and metric flush.
+import { createHash } from 'node:crypto';
 import {
   loadSession,
   saveSessionAsync,
@@ -29,6 +30,7 @@ import { hideCompactionArchive } from '../compaction-archive-capture.mjs';
 import { writeStderrBestEffort } from '../../../../shared/best-effort-stderr.mjs';
 import { forgetSideQuestion } from '../side-question-store.mjs';
 import { isAgentHomeSessionId } from '../agent-home.mjs';
+import { messageIdOf } from '../message-ids.mjs';
 
 /** Force-flush session metrics to disk. */
 export async function flushSessionMetrics(sessionId) {
@@ -412,19 +414,36 @@ export async function updateSessionStatus(id, status) {
 export async function rewindSessionMessagesTo(sessionId, options = {}) {
   const session = loadSession(sessionId);
   if (!session || session.closed === true) return null;
+  const targetId = String(options?.messageId ?? '').trim();
   const target = String(options?.text ?? '').trim();
-  if (!target) return null;
+  if (!targetId && !target) return null;
   const messages = Array.isArray(session.messages) ? session.messages : [];
-  let start = -1;
+  // The stable message id is the identity: the stored prompt is the EXPANDED
+  // text (attachment tokens materialized), so display text cannot find it.
+  // Text is only the fallback for a row that carries no id.
+  const matches = targetId
+    ? (message) => messageIdOf(message) === targetId
+    : (message) => promptContentText(message.content).trim() === target;
+  const found = [];
   for (let index = messages.length - 1; index >= 0; index -= 1) {
-    const message = messages[index];
-    if (message?.role !== 'user') continue;
-    if (promptContentText(message.content).trim() !== target) continue;
-    start = index;
-    break;
+    if (messages[index]?.role === 'user' && matches(messages[index])) found.push(index);
   }
-  if (start < 0) return null;
+  // Without an id, text that several prompts repeat cannot say which one the
+  // user picked: refuse rather than rewind the wrong occurrence.
+  if (found.length === 0 || (!targetId && found.length > 1)) return null;
+  const start = found[0];
   const removed = messages.length - start;
+  const rewoundMessage = messages[start];
+  // `dryRun` resolves the target and reports what a rewind would do, changing
+  // nothing: the caller prepares the restore payload first and commits after.
+  // The marker names the exact history the dry run saw (generation alone only
+  // moves on lifecycle changes); the commit passes it back and is refused when
+  // the history differs.
+  const historyMarker = `${session.generation ?? 0}:${messages.length}:${createHash('sha1')
+    .update(JSON.stringify(messages))
+    .digest('hex')}`;
+  if (options?.dryRun === true) return { removed, remaining: start, message: rewoundMessage, historyMarker };
+  if (options?.expectedHistoryMarker != null && options.expectedHistoryMarker !== historyMarker) return null;
   session.messages = messages.slice(0, start);
   // The provider cache is keyed on the exact prefix we just truncated;
   // the prefix-guard snapshot and the /btw fork request describe it too and
@@ -435,5 +454,5 @@ export async function rewindSessionMessagesTo(sessionId, options = {}) {
   session.updatedAt = Date.now();
   session.lastUsedAt = Date.now();
   await saveSessionAsync(session, { expectedGeneration: session.generation });
-  return { removed, remaining: session.messages.length };
+  return { removed, remaining: session.messages.length, message: rewoundMessage };
 }

package/src/runtime/agent/orchestrator/session/manager/session-lifecycle.mjs

@@ -15,10 +15,11 @@ import { loadConfig } from '../../config.mjs';
 import {
   buildProviderCacheOpts,
   cacheCapabilityForProvider,
+  isLeadCacheClass,
   roleProviderCacheOpts,
 } from '../../agent-runtime/cache-strategy.mjs';
 import { normalizeAutoClearConfig, resolveAutoClearIdleMs } from '../../runtime-core/config-helpers.mjs';
-import { _buildBaseRules } from './rules-cache.mjs';
+import { _buildBaseRules, promptRulesRevision } from './rules-cache.mjs';
 import { stripProviderReplayMessages } from './provider-replay.mjs';
 import { composeSessionSystem, seedSessionMessages } from './session-prompt-composition.mjs';
 import { agentProfileRevision, leadRosterRevision } from '../../context/role-instructions.mjs';
@@ -41,6 +42,7 @@ import { ensureCodexWireSessionId, mintSessionId } from './session-id.mjs';
 import { providerCacheKey } from './provider-cache-key.mjs';
 import { buildSessionRecord, normalizeDesktopSessionMetadata, sessionOriginFields } from './session-record.mjs';
 import { normalizeWorkflowRoute } from '../../runtime-core/workflow.mjs';
+import { ownerRouteFallbacks } from './owner-route-fallbacks.mjs';
 import { applyPendingWorkspaceReroot, refreshSessionBp3Environment } from './prompt-utils.mjs';
 import { isWorktreeBound } from '../../../../shared/worktrees/contract.mjs';
 import { applyAgentToolExposure } from '../loop/tool-exposure-migration.mjs';
@@ -53,17 +55,20 @@ export { recoverSessionAfterProcessRestart } from './turn-checkpoint-recovery.mj
 // re-exported so prior importers of this module stay unchanged.
 export { prefetchSession, prepareSessionProjection } from './prepared-resume-cache.mjs';
 
-function buildSessionProviderCacheOpts(providerName, sessionId, agent = null, config = null) {
+// `session` is the record or create options; it classifies agent-mode Leads
+// (bot home threads, routine runs) into the Lead cache class.
+function buildSessionProviderCacheOpts(providerName, sessionId, agent = null, config = null, session = null) {
   // Keep this in sync with createSession's provider-cache policy: only
-  // explicit-breakpoint providers get BP cache opts here; OpenAI/key-prefix
-  // providers use promptCacheKey and request-time strategy instead, plus the
-  // shared prompt-cache scope of a one-shot role.
+  // explicit-breakpoint providers get BP cache opts here; key-prefix
+  // providers use promptCacheKey and request-time strategy instead (plus the
+  // OpenAI API's Lead-class 12h prefix TTL and a one-shot role's shared
+  // prompt-cache scope).
   if (cacheCapabilityForProvider(providerName) !== 'explicit-breakpoint') {
-    return roleProviderCacheOpts(providerName, agent);
+    return roleProviderCacheOpts(providerName, agent, { session });
   }
   try {
     let autoClear = null;
-    if (!agent || agent === 'lead') {
+    if (isLeadCacheClass(agent, session)) {
       const loadedConfig = config || loadConfig({ secrets: false });
       const normalizedAutoClear = normalizeAutoClearConfig(loadedConfig?.autoClear);
       autoClear = {
@@ -71,20 +76,23 @@ function buildSessionProviderCacheOpts(providerName, sessionId, agent = null, co
         idleMs: resolveAutoClearIdleMs(loadedConfig, providerName),
       };
     }
-    return buildProviderCacheOpts(providerName, sessionId, agent, { autoClear });
+    return buildProviderCacheOpts(providerName, sessionId, agent, { autoClear, session });
   } catch {
     return null;
   }
 }
 
-// Re-derive a Lead session's builder-made cache policy (messages TTL follows
-// the auto-clear idle window). Explicit caller/profile policies, non-Lead
-// sessions and non-explicit-breakpoint providers are left untouched.
+// Re-derive a Lead-class session's builder-made cache policy (Anthropic
+// messages TTL follows the auto-clear idle window; the OpenAI API prefix TTL
+// follows the cache class). Explicit caller/profile policies, sub-agents and
+// other providers are left untouched.
 export function refreshSessionProviderCacheOpts(session, config = null) {
   if (!session || session.providerCacheOptsOverride === true) return false;
-  if (session.agent && session.agent !== 'lead') return false;
-  if (cacheCapabilityForProvider(session.provider) !== 'explicit-breakpoint') return false;
-  const next = buildSessionProviderCacheOpts(session.provider, session.id, session.agent, config);
+  if (!isLeadCacheClass(session.agent, session)) return false;
+  if (cacheCapabilityForProvider(session.provider) !== 'explicit-breakpoint' && session.provider !== 'openai') {
+    return false;
+  }
+  const next = buildSessionProviderCacheOpts(session.provider, session.id, session.agent, config, session);
   if (!next) return false;
   session.providerCacheOpts = next;
   return true;
@@ -225,26 +233,35 @@ export function createSession(createOpts) {
     sessionMode === AGENT_MODE && !createOpts.agent && actingAgent
       ? { ...createOpts, agent: actingAgent, sessionMode }
       : { ...createOpts, sessionMode };
-  const routeFallbacks = normalizeWorkflowRoute({
-    provider: providerName,
-    model: modelName,
-    fallbacks: Object.hasOwn(opts, 'routeFallbacks') ? opts.routeFallbacks : presetObj?.fallbacks,
-  })?.fallbacks;
+  // A Lead-class session (actingAgent set) takes its owner's chain while it
+  // runs on the owner's primary model; an agent keeps its preset's.
+  const routeFallbacks = actingAgent
+    ? Object.hasOwn(opts, 'routeFallbacks')
+      ? opts.routeFallbacks
+      : ownerRouteFallbacks({ sessionMode, agentId: actingAgent, provider: providerName, model: modelName })
+    : normalizeWorkflowRoute({
+        provider: providerName,
+        model: modelName,
+        fallbacks: Object.hasOwn(opts, 'routeFallbacks') ? opts.routeFallbacks : presetObj?.fallbacks,
+      })?.fallbacks;
   // Provider cache strategy — agentRuntime.resolveSync() above is a
   // best-effort injection point (setAgentRuntime() has no live caller
   // today, so that branch never fires); build it directly here so every
-  // session still gets a cache strategy. Lead sessions (opts.agent ===
-  // 'lead', or no agent at all — raw/CLI callers) get their BP4 message
-  // tail TTL linked to the user's autoClear idle-sweep config; hidden and
-  // public agents keep the flat 5m default (see cache-strategy.mjs docs).
-  // Scoped to explicit-breakpoint (Anthropic-family) providers only.
-  const providerCacheOpts = resolved.providerCacheOpts || buildSessionProviderCacheOpts(providerName, id, opts.agent);
+  // session still gets a cache strategy. Lead-class sessions (the Lead, raw
+  // callers, bot home threads and other agent-mode Leads) get their BP4
+  // message tail TTL linked to the user's autoClear idle-sweep config and,
+  // on the OpenAI API, the 12h stable-prefix TTL; sub-agents and hidden roles
+  // keep the agent defaults (see cache-strategy.mjs docs).
+  const providerCacheOpts =
+    resolved.providerCacheOpts || buildSessionProviderCacheOpts(providerName, id, opts.agent, null, { ...opts, id });
   const surface = resolveSessionToolSurface(opts, { profile, toolPreset, modelName });
   // The agent profile the prompt is composed from, read first: an edit landing
   // during composition leaves the stamp behind, never ahead (refreshAgentProfile).
   const agentProfile = surface.ownerIsAgent
     ? ''
     : agentProfileRevision(surface.resolvedAgent, { mixy: sessionMode === AGENT_MODE });
+  // A bot thread lives on across releases: the rules it was built from.
+  const rulesRevision = agentProfile && sessionMode === AGENT_MODE ? promptRulesRevision() : '';
   const prompt = composeSessionSystem(opts, { profile, providerName, modelName, surface, sessionMode });
   const messages = seedSessionMessages(prompt, opts.files);
   logSessionSurface(surface);
@@ -268,6 +285,7 @@ export function createSession(createOpts) {
     session.agentProfileRevision = agentProfile;
     // The bot roster its prompt lists (a Lead's catalog slices).
     session.agentRosterRevision = leadRosterRevision(opts.leadWorkflowParts);
+    if (rulesRevision) session.rulesRevision = rulesRevision;
   }
   if (routeFallbacks?.length) session.routeFallbacks = routeFallbacks;
   // A non-native agent sends core + bridge, built from its filtered tools.
@@ -340,6 +358,13 @@ function applyRouteFields(session, route) {
     else delete session.autoEffort;
   }
   if (Object.hasOwn(route, 'effort')) session.effort = route.effort || null;
+  // A deliberate route choice restarts the chain (a fallback hop never passes this).
+  if (Object.hasOwn(route, 'routeFallbacks')) {
+    if (route.routeFallbacks?.length) session.routeFallbacks = route.routeFallbacks;
+    else delete session.routeFallbacks;
+    delete session.routeFallbackIndex;
+    delete session.routeFallbackFailures;
+  }
   ensureCodexWireSessionId(session);
   if (Object.hasOwn(route, 'modelParameters')) {
     session.modelParameters =
@@ -387,7 +412,8 @@ function applyRouteContextWindow(session, routeChanged, selectedContextWindowPro
 // surface: the previous route's readings and prepared tools no longer apply.
 function resetSessionForRouteChange(id, session, previousModel, previousProvider) {
   session.promptCacheKey = providerCacheKey(session.provider);
-  session.providerCacheOpts = buildSessionProviderCacheOpts(session.provider, session.id, session.agent) || null;
+  session.providerCacheOpts =
+    buildSessionProviderCacheOpts(session.provider, session.id, session.agent, null, session) || null;
   session.providerCacheOptsOverride = false;
   session.lastInputTokens = 0;
   session.lastOutputTokens = 0;
@@ -437,7 +463,9 @@ function stripProviderReplay(session) {
 // auto-compacts) against the new model's window.
 export function updateSessionRoute(id, route = {}, options = {}) {
   if (!id) return null;
-  const session = loadSession(id);
+  // options.session: the live object of a running turn, changed in place; the id's
+  // stored copy (a disk reload after another process took the generation) is not.
+  const session = options.session?.id === id ? options.session : loadSession(id);
   if (!session || session.closed === true) return null;
   const previousProvider = session.provider || null;
   const previousModel = session.model || null;

package/src/runtime/agent/orchestrator/session/manager/session-prompt-composition.mjs

@@ -5,7 +5,7 @@
 import { buildSkillManifest, composeSystemPrompt } from '../../context/collect.mjs';
 import { configuredInstructionFilesMode, loadInstructionFilesContext } from '../../context/instruction-files.mjs';
 import { agentModeIdentityLine } from '../../context/role-instructions.mjs';
-import { AGENT_MODE, isRoutineSource, sessionModeOf } from '../agent-mode.mjs';
+import { AGENT_MODE, sessionModeOf } from '../agent-mode.mjs';
 import { MIXY_AGENT_ID } from '../agent-home.mjs';
 import {
   _buildBaseRules,
@@ -98,12 +98,9 @@ export function buildWorkspacePromptContext(session, cwd) {
 // A Lead's BP3 rule slices, ordered for prefix sharing (composeSystemPrompt):
 // LEAD.md's common lines first; then the mode block (coding: LEAD.md's two
 // passages; agent mode: their conversational variants and AGENT_MODE.md);
-// then Mixy's MIXY.md; last the per-session tail — routine line, identity.
+// then Mixy's MIXY.md; last the per-session tail — identity.
 // Agent mode is a Lead created as an agent (agent-mode.mjs).
-export function sessionRolePromptFields(
-  identity,
-  { ownerIsAgent, toolFreeRole, delegationFree, sessionMode, routine = false }
-) {
+export function sessionRolePromptFields(identity, { ownerIsAgent, toolFreeRole, delegationFree, sessionMode }) {
   const skipRules = identity.skipAgentRules || toolFreeRole;
   const lead = !ownerIsAgent && !skipRules;
   const agentMode = lead && sessionMode === AGENT_MODE;
@@ -131,7 +128,6 @@ export function sessionRolePromptFields(
       ? {
           agentModeRules: _buildAgentModeRules({ part: 'conduct' }),
           ...(mixy ? { mixyRules: _buildAgentModeRules({ part: 'mixy' }) } : {}),
-          ...(routine ? { routineRules: _buildAgentModeRules({ part: 'routine' }) } : {}),
         }
       : {}),
     userPrompt: identity.systemPrompt,
@@ -163,7 +159,7 @@ export function composeSessionSystem(opts, { profile, providerName, modelName, s
         provider: providerName,
         model: modelName,
       });
-  const delegationFree = delegationDisabled(opts, ownerIsAgent);
+  const delegationFree = delegationDisabled({ ...opts, sessionMode }, ownerIsAgent);
   const promptIdentity = {
     systemPrompt: opts.systemPrompt || '',
     skipAgentRules: opts.skipAgentRules === true,
@@ -176,7 +172,6 @@ export function composeSessionSystem(opts, { profile, providerName, modelName, s
     toolFreeRole,
     delegationFree,
     sessionMode,
-    routine: isRoutineSource(opts.sourceType),
   });
   const leadOnly = !skipAgentRules && !ownerIsAgent;
   const metaContext = leadOnly ? _buildLeadMetaContext({ includeOutputStyle: !agentMode }) : '';

package/src/runtime/agent/orchestrator/session/manager/session-record.mjs

@@ -2,8 +2,10 @@
 // What a persisted session row contains and where each field comes from: the
 // compaction budget, the origin/permission/cache metadata analytics slice on,
 // the desktop classification, and the record assembled from them. Everything
-// here is field derivation — no I/O, no ownership, no prompt text.
+// here is field derivation — no ownership, no prompt text; the only read is the
+// parent's record a delegated session takes its root from.
 import { toSessionWorkflowMeta } from '../../runtime-core/workflow.mjs';
+import { delegationForNewSession, runForNewSession } from '../human-gate/delegation.mjs';
 import { sessionOrchestrationMode } from '../../../../shared/orchestration.mjs';
 import { preserveBufferConfigFields } from './context-meta.mjs';
 import { positiveInt } from '../../../../shared/numbers.mjs';
@@ -101,9 +103,20 @@ export function sessionOriginFields(opts, { profile, presetObj, providerCacheOpt
     ownerSessionId: opts.ownerSessionId || null,
     visibility: opts.visibility || null,
     clientHostPid: opts.clientHostPid || null,
+    // A sub-agent's root and the run (if any) that started a sub-agent or a
+    // bot-created task session, derived from its creator — the one read here —
+    // never taken from the options (human-gate/delegation.mjs).
+    ...delegationFields(opts),
   };
 }
 
+function delegationFields(opts) {
+  const delegation = delegationForNewSession(opts);
+  // Work a schedule/webhook run started (a sub-agent, a task session) stays the run's.
+  const run = runForNewSession(opts);
+  return { ...(delegation ? { delegation } : {}), ...(run ? { run } : {}) };
+}
+
 // The persisted session record.
 export function buildSessionRecord({ opts, route, presetObj, surface, prompt, messages, contextMeta, origin }) {
   const {

package/src/runtime/agent/orchestrator/session/manager/session-tool-surface.mjs

@@ -9,15 +9,19 @@ import { collectPromptSkillsCached } from '../../context/collect.mjs';
 import { isAgentOwner } from '../../agent-owner.mjs';
 import { getHiddenAgent } from '../../internal-agents.mjs';
 import { workflowDisallowsAgentTool } from '../../runtime-core/workflow.mjs';
+import { isAgentModeSession } from '../agent-mode.mjs';
 import { finalizeSessionToolList, resolveSessionTools, permissionFromToolSpec } from './tool-resolution.mjs';
 import { unusedModelEditToolName } from '../../../../shared/edit-tool-dialect.mjs';
 import { getAgentRuntimeSync } from './agent-runtime-singleton.mjs';
 
 // A lead session may not delegate when its workflow forbids the agent tool
-// (no delegatable agents); Solo keeps it deferred for explicit user requests.
-// An agent-owned session never gets the tool anyway.
+// (an agent-mode Lead without delegatable agents); Solo keeps it deferred for
+// explicit user requests. An agent-owned session never gets the tool anyway.
 export function delegationDisabled(source, ownerIsAgent) {
-  return !ownerIsAgent && workflowDisallowsAgentTool(source?.workflow);
+  return (
+    !ownerIsAgent &&
+    workflowDisallowsAgentTool(source?.workflow, { agentMode: Boolean(source) && isAgentModeSession(source) })
+  );
 }
 
 // Exactly two schema surfaces exist: Lead and Agent. Every Agent role gets

package/src/runtime/agent/orchestrator/session/manager/turn-checkpoint-journal.mjs

@@ -35,10 +35,9 @@
 // keeps the durable prefix.
 import { appendFileSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
 import { appendFile, unlink, writeFile } from 'node:fs/promises';
-import { randomBytes } from 'node:crypto';
 import { join } from 'node:path';
 import { getPluginData } from '../../config.mjs';
-import { renameWithRetrySync } from '../../../../shared/atomic-file.mjs';
+import { writeFileAtomicSync } from '../../../../shared/atomic-file.mjs';
 import { sanitizeContentForStoredHistory } from '../../providers/media-normalization.mjs';
 import { promptContentText } from './prompt-utils.mjs';
 
@@ -145,19 +144,11 @@ export function writeCheckpointHeader(checkpoint) {
     contextState: checkpoint.contextState ?? null,
     updatedAt: Date.now(),
   };
-  const temp = `${target}.${randomBytes(6).toString('hex')}.tmp`;
-  try {
-    writeFileSync(temp, JSON.stringify(payload), 'utf8');
-    renameWithRetrySync(temp, target);
-    return true;
-  } catch (error) {
-    try {
-      unlinkSync(temp);
-    } catch {
-      /* best-effort */
-    }
-    throw error;
-  }
+  // Durable (fsynced through its handle, then renamed): a crash must not
+  // publish a header whose bytes never landed. A damaged header already reads
+  // as "no checkpoint" (parseTurnCheckpointHeader) and the next turn rewrites it.
+  writeFileAtomicSync(target, JSON.stringify(payload));
+  return true;
 }
 
 export function readTurnCheckpointHeader(sessionId) {

package/src/runtime/agent/orchestrator/session/manager/turn-interruption.mjs

@@ -20,7 +20,15 @@ const INTERRUPTED_TOOL_RESULT = 'Cancelled';
 // PRESERVE the just-sent user turn: nothing restores the prompt there, and
 // rewinding erases the user's message from the persisted transcript (the
 // exact loss seen when the desktop app quits mid-turn).
-const USER_CANCEL_ABORT_REASONS = new Set(['cli-abort', 'user-cancel', 'turn-abort']);
+//
+// A user cancel the host will NOT answer with the prompt back in the input box
+// (the desktop Stop button, a prompt carrying attachments cancelled from
+// another device) names `USER_CANCEL_KEEP_PROMPT_REASON`: it is still a user
+// cancel, but the unanswered prompt stays in the stored transcript. Rewinding
+// it left a first message with zero stored messages — a session every catalog
+// hides — and its text nowhere.
+export const USER_CANCEL_KEEP_PROMPT_REASON = 'user-cancel-keep-prompt';
+const USER_CANCEL_ABORT_REASONS = new Set(['cli-abort', 'user-cancel', 'turn-abort', USER_CANCEL_KEEP_PROMPT_REASON]);
 
 function provisionalUserTurnIndex(messages, currentUserContent) {
   const currentText = promptContentText(currentUserContent);
@@ -78,7 +86,17 @@ function finalizeInterruptedTurn({
   // turn and its side effects from history.
   const preserveResponse = responseStarted && (producedOutput || !userCancelled);
   if (!preserveResponse) {
-    if (!userCancelled) {
+    if (!userCancelled || abortReason === USER_CANCEL_KEEP_PROMPT_REASON) {
+      // A kept prompt gets the generic interruption row (rendered as the
+      // Cancelled status, unlike the hidden by-user control row): without it a
+      // rebuilt transcript shows the stopped prompt as if it were still
+      // awaiting an answer, directly above the next one.
+      if (
+        abortReason === USER_CANCEL_KEEP_PROMPT_REASON &&
+        provisionalUserTurnIndex(messages, currentUserContent) >= 0
+      ) {
+        messages.push({ role: 'user', content: SESSION_INTERRUPT_MESSAGE });
+      }
       return {
         messages,
         responsePreserved: false,
@@ -145,18 +163,16 @@ function appendObservedTurnOutput(
     if (!result?.toolCallId || representedToolResultIds.has(result.toolCallId)) continue;
     messages.push({
       role: 'tool',
-      content: result.content == null ? '' : result.content,
+      content: result.content ?? '',
       toolCallId: result.toolCallId,
       ...(result.toolKind ? { toolKind: result.toolKind } : {}),
     });
     representedToolResultIds.add(result.toolCallId);
   }
 
-  const allToolCallIds = [];
+  const allToolCallIds = new Set();
   for (const message of messages) {
-    for (const id of assistantToolCallIds(message)) {
-      if (!allToolCallIds.includes(id)) allToolCallIds.push(id);
-    }
+    for (const id of assistantToolCallIds(message)) allToolCallIds.add(id);
   }
   for (const callId of allToolCallIds) {
     if (representedToolResultIds.has(callId)) continue;
@@ -283,7 +299,7 @@ export function createTurnInterruptionTracker() {
       if (message.__earlyNotify === true) {
         state.observedToolResults.set(callId, {
           role: 'tool',
-          content: message.content == null ? '' : message.content,
+          content: message.content ?? '',
           toolCallId: callId,
           toolKind: message.toolKind || (message.isError ? 'error' : null),
         });

package/src/runtime/agent/orchestrator/session/manager/workflow-switch-notice.mjs

@@ -1,20 +1,97 @@
 // manager/workflow-switch-notice.mjs
 // A mid-conversation workflow switch (session-runtime/tool-policy-refresh.mjs
-// switchSessionWorkflow) rebuilds the session's prompt and tool surface and
-// stages `session.workflowSwitch`, the one-time notice the next user turn
-// carries in its reminder block. Lifecycle mirrors the working-folder notice
-// (prompt-utils snapshotPendingWorkspaceNotice): snapshot when the turn is
-// built, acknowledge once the provider accepted it, so a failed turn re-sends
-// it. The state object is replaced, never mutated:
-//   from — the workflow the model was last told about (kept across switches
-//          made before a notice reached it);
-//   to   — the workflow the prompt carries now.
+// switchSessionWorkflow) leaves the request prefix — system blocks and tool
+// schemas — byte-identical, so the provider cache survives. The switch lives
+// in two pieces of session state:
+//   session.workflowOverlay — while the session's workflow differs from the
+//     one its system prompt carries: the prompt's workflow (`prompt`, and the
+//     orchestration mode its tool surface was built with), the new workflow,
+//     its tools that are refused at call time (`deniedTools`), the tools it
+//     allows that this session cannot reach (`unavailableTools`) and the
+//     self-contained reminder (`content`) with the new workflow's rules,
+//     orchestration and agents. It is folded into the prompt (and dropped) at
+//     the next point where the cache is cold anyway (tool-policy-refresh.mjs).
+//   session.workflowSwitch — the notice the next user turn carries in its
+//     reminder block. Lifecycle mirrors the working-folder notice
+//     (prompt-utils snapshotPendingWorkspaceNotice): snapshot when the turn is
+//     built, acknowledge once the provider accepted it, so a failed turn
+//     re-sends it. Delivered, it stays in the conversation. Replaced, never
+//     mutated:
+//       from — the workflow the model was last told about (kept across
+//              switches made before a notice reached it);
+//       to   — the session's workflow now.
+// Every notice says it replaces the earlier ones, so the latest one wins.
 
 function workflowRef(workflow) {
   const id = String(workflow?.id || '').trim();
   return id ? { id, name: String(workflow?.name || id).trim() } : null;
 }
 
+/** The workflow the session's system prompt and tool surface were built with. */
+export function promptWorkflowOf(session) {
+  return session?.workflowOverlay?.prompt || session?.workflow || null;
+}
+
+const lower = (name) => String(name || '').toLowerCase();
+
+/** The refusal of a call to a tool the session's current workflow denies
+ *  while its schema (built for the prompt's workflow) still carries it; null
+ *  for any other call. */
+export function workflowOverlayDenial(session, name) {
+  const overlay = session?.workflowOverlay;
+  if (!overlay?.deniedTools?.some((denied) => lower(denied) === lower(name))) return null;
+  return `Error: tool "${name}" is not available in workflow ${overlay.workflow.name}: this conversation switched to it. Do the work without it.`;
+}
+
+const listed = (names) => names.map((name) => `\`${name}\``).join(', ');
+
+/** The reminder that makes the Lead follow `workflow` while its system prompt
+ *  still carries `promptName`'s: self-contained (rules, orchestration, agents,
+ *  tool changes) and superseding every earlier one. */
+export function workflowOverlayContent({
+  promptName,
+  workflow,
+  instructions,
+  deniedTools = [],
+  loadableTools = [],
+  unavailableTools = [],
+}) {
+  const name = workflow.name;
+  return [
+    '<system-reminder>',
+    '# Workflow Changed',
+    `This conversation now runs the ${name} workflow. The system prompt's Active Workflow, orchestration mode and available agents are still ${promptName}'s: they no longer apply; follow ${name}'s below instead. This replaces every earlier Workflow Changed reminder in this conversation.`,
+    ...(deniedTools.length ? [`Not available in ${name} (calls are refused): ${listed(deniedTools)}.`] : []),
+    ...(loadableTools.length
+      ? [
+          `${name} adds ${listed(loadableTools)}: not among your directly defined tools yet; load ${loadableTools.length === 1 ? 'it' : 'them'} with \`load_tool\` before the first call.`,
+        ]
+      : []),
+    ...(unavailableTools.length
+      ? [`${name} allows ${listed(unavailableTools)}, but this session cannot use them; a new session can.`]
+      : []),
+    `Agents already started under ${promptName} keep running with their own instructions; new delegation follows ${name}.`,
+    '',
+    instructions,
+    '</system-reminder>',
+  ].join('\n');
+}
+
+function messageText(message) {
+  if (typeof message?.content === 'string') return message.content;
+  if (!Array.isArray(message?.content)) return '';
+  return message.content.map((part) => (typeof part === 'string' ? part : part?.text || '')).join('');
+}
+
+/** The conversation still holds `content` (a delivered reminder); false once
+ *  a compaction or a clear dropped it. */
+export function conversationHolds(session, content) {
+  if (!content) return false;
+  return (Array.isArray(session?.messages) ? session.messages : []).some(
+    (message) => message?.role !== 'system' && messageText(message).includes(content)
+  );
+}
+
 /** Stage the notice of a switch from `from` to `to`; a switch back to what the
  *  model was last told drops it. Returns the staged state or null. */
 export function stageWorkflowSwitchNotice(session, from, to) {
@@ -29,13 +106,14 @@ export function stageWorkflowSwitchNotice(session, from, to) {
   return session.workflowSwitch;
 }
 
-function workflowNoticeContent({ from, to }) {
+// The prompt itself carries `to` (a switch back to it, or the overlay folded in).
+function promptWorkflowNoticeContent({ from, to }) {
   const before = from?.name || 'the previous workflow';
   return [
     '<system-reminder>',
     '# Workflow Changed',
-    `The workflow changed from ${before} to ${to.name}. Earlier turns of this conversation ran under ${before}; the system prompt was updated in place, so its Active Workflow rules, delegation instructions, available agents and tools are now those of ${to.name}. Follow them from this turn on.`,
-    `Agents already started under ${before} keep running with their own instructions; new delegation uses the current tools and agents.`,
+    `This conversation now runs the ${to.name} workflow, the one the system prompt carries: its Active Workflow, orchestration mode, available agents and tools apply. This replaces every earlier Workflow Changed reminder in this conversation.`,
+    `Agents already started under ${before} keep running with their own instructions; new delegation follows ${to.name}.`,
     '</system-reminder>',
   ].join('\n');
 }
@@ -47,7 +125,10 @@ function workflowNoticeContent({ from, to }) {
 export function snapshotPendingWorkflowNotice(session) {
   const pending = session?.workflowSwitch;
   if (!pending?.to?.id) return null;
-  return { revision: pending.revision, content: workflowNoticeContent(pending) };
+  const overlay = session.workflowOverlay;
+  const content =
+    overlay?.workflow?.id === pending.to.id && overlay.content ? overlay.content : promptWorkflowNoticeContent(pending);
+  return { revision: pending.revision, content };
 }
 
 /** The notice of `revision` reached the model: nothing is due any more. */