mixdog 1.3.1 → 1.3.3

package/src/runtime/agent/orchestrator/session/store/load-cache.mjs

@@ -2,6 +2,7 @@ import { statSync, readFileSync } from 'node:fs';
 import { getPluginData } from '../../config.mjs';
 import { readTopLevelLifecycleRecord, isLifecycleUnreadable } from '../lifecycle-scan.mjs';
 import { shareJsonStrings } from '../../../../shared/json-snapshot.mjs';
+import { holdsNoData } from '../../../../shared/atomic-file.mjs';
 import {
   sessionStampOf,
   ownCommittedLifecycle,
@@ -227,6 +228,13 @@ function _ownedSession(id, text) {
   return _ownedRecord(id, text)?.doc ?? null;
 }
 
+// A file that holds no data (empty or NUL-filled by a crash) is not a session
+// that could own the identity: it reads as absent, so the id can be saved over
+// or deleted instead of staying a ghost.
+function _outcomeOfText(id, text) {
+  return holdsNoData(text) ? { exists: false, session: null } : { exists: true, session: _ownedSession(id, text) };
+}
+
 // `entry` is a cached (in-map) entry.
 function _selectCachedSession(entry, preferInMemory) {
   const preferred = preferInMemory?.(entry.header);
@@ -297,7 +305,7 @@ function _decisiveReplacementSnapshot(id, path) {
     const code = err?.code || 'EUNKNOWN';
     return ABSENT_CODES.has(code) ? { exists: false, session: null } : { exists: true, session: null };
   }
-  return { exists: true, session: _ownedSession(id, text) };
+  return _outcomeOfText(id, text);
 }
 
 export function _readStoredSessionCached(id, path, { preferInMemory = null } = {}) {
@@ -391,7 +399,11 @@ export function _readStoredSessionCached(id, path, { preferInMemory = null } = {
       // (uncached, since no identity was verified) rather than invent an
       // absence/null for a perfectly readable replacement; otherwise
       // stay conservatively present-but-invalid.
-      return { exists: true, session: _ownedSession(id, text) };
+      return _outcomeOfText(id, text);
+    }
+    if (holdsNoData(text)) {
+      _dropCached(path);
+      return { exists: false, session: null };
     }
     // Stable snapshot: `text` provably belongs to the file identified by
     // `before`. Whatever it says is now authoritative, including "this is

package/src/runtime/agent/orchestrator/session/store/session-delete.mjs

@@ -13,6 +13,7 @@ import { getStoreDir, sessionPath } from './session-paths.mjs';
 import {
   readCanonicalSessionRecord as _readCanonicalRecord,
   CANONICAL_RECORD_UNREADABLE as LIFECYCLE_AMBIGUOUS,
+  setAsideDamagedSessionRecord,
 } from './canonical-reader.mjs';
 import { probePath, PROBE_PRESENT, PROBE_ABSENT } from './fs-probe.mjs';
 import {
@@ -106,9 +107,22 @@ export function deleteSession(id, options = {}) {
       // probe and this read another process can rename a different session's
       // record (or a torn write) onto this path, and an unlink is
       // irreversible. Ambiguous/foreign bytes are therefore never deleted.
-      const record = _readCanonicalRecord(path);
+      let record = _readCanonicalRecord(path);
+      // A record that holds no data or is not JSON is damage, not somebody's
+      // session: keep its bytes aside so the delete can finish.
+      if (record === null || record === LIFECYCLE_AMBIGUOUS) {
+        try {
+          if (setAsideDamagedSessionRecord(path)) record = null;
+        } catch {
+          return false; // could not move it: nothing was deleted
+        }
+      }
       if (record === LIFECYCLE_AMBIGUOUS) return false;
       if (record !== null) {
+        // Damage-only mode (a caller's no-data verdict was taken before this
+        // lock): content that is valid now was repaired or republished since,
+        // and is never deleted.
+        if (options.damagedOnly === true) return false;
         if (record.id !== id) return false;
         try {
           unlinkSync(path);

package/src/runtime/agent/orchestrator/session/store/sweep/stale-sweep.mjs

@@ -21,8 +21,8 @@ function* sweepStaleSessionSteps(ttlMs, options = {}) {
   // An unreadable store dir is not an empty one: sweeping (deleting,
   // closing, pruning) on a probe we could not make is never allowed.
   if (probePath(dir).state !== PROBE_PRESENT) {
-    const { openCandidates: _candidates, ...empty } = createSweepTally();
-    return empty;
+    const { openCandidates: _candidates, subAgents, ...empty } = createSweepTally();
+    return plan.retainSubAgents ? { ...empty, subAgents } : empty;
   }
   const rows = collectSweepRows(dir);
   pruneSweepRecordCache(new Set(rows.map((row) => row?.id).filter(Boolean)));
@@ -41,8 +41,9 @@ function* sweepStaleSessionSteps(ttlMs, options = {}) {
   yield* reapOrphanSidecars(ctx);
   queueDeletedSummaryPrune(ctx.tally);
   persistSweepRecordCache();
-  const { openCandidates: _candidates, ...result } = ctx.tally;
-  return result;
+  const { openCandidates: _candidates, subAgents, ...result } = ctx.tally;
+  // `subAgents` only for a caller that applies them (idle-cleanup.mjs).
+  return plan.retainSubAgents ? { ...result, subAgents } : result;
 }
 
 /** Synchronous compatibility surface for explicit maintenance commands/tests. */

package/src/runtime/agent/orchestrator/session/store/sweep/sub-agent-retention.mjs

@@ -0,0 +1,140 @@
+// sweep/sub-agent-retention.mjs
+// Retention of finished sub-agent sessions: the agent-only children (Worker,
+// Reviewer, ...) a Lead's agents spawn, each its own stored session. The idle
+// sweep names every sub-agent record with its STORED activity time (the clock
+// survives restarts); a tree — a top sub-agent under a Lead with every
+// sub-agent below it — is archived once each member is idle
+// SUB_AGENT_ARCHIVE_AFTER_MS and deleted once each is idle
+// SUB_AGENT_DELETE_AFTER_MS. Otherwise the whole tree stays as it is.
+// Never a member: a root Lead, a task session from `session create`, a bot
+// home chat or a group room's log/member session.
+import { agentParentIds, isAgentOnlySession, isRootLeadSession } from '../../store-summary-visibility.mjs';
+import { probePath, PROBE_PRESENT } from '../fs-probe.mjs';
+import { sessionPath } from '../session-paths.mjs';
+import { _queueSummaryIndexPrune } from '../summary-cache.mjs';
+import { deleteSession } from '../session-delete.mjs';
+import { readSweepRecord } from './sweep-record.mjs';
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+export const SUB_AGENT_ARCHIVE_AFTER_MS = 3 * DAY_MS;
+export const SUB_AGENT_DELETE_AFTER_MS = 30 * DAY_MS;
+const PERMANENT_ID = /^sess_(?:home|room|rmem)_/;
+// The desktop change an automatic archive applies: that one session, no
+// cascade (an explicit archive of a parent takes its sub-agents along).
+export const SUB_AGENT_AUTO_ARCHIVE = Object.freeze({ archived: true, cascade: false });
+
+const positive = (value) => (Number(value) > 0 ? Number(value) : 0);
+
+/** Last activity of a stored record: its last conversation turn (`lastUsedAt`;
+ *  `updatedAt` also moves on detach/resume bookkeeping) or its heartbeat. */
+export function subAgentActivityAt(doc) {
+  return Math.max(
+    positive(doc?.lastUsedAt) || positive(doc?.updatedAt) || positive(doc?.createdAt),
+    positive(doc?.lastHeartbeatAt)
+  );
+}
+
+/** `{ id, parentIds, lastActive }` for a sub-agent record (open or closed);
+ *  null for anything else. `parentIds` are the owner and parent links the
+ *  record names (agentParentIds), the same ones an archive cascade follows. */
+export function subAgentMember(id, doc) {
+  if (!doc || PERMANENT_ID.test(id) || doc.taskOrigin) return null;
+  if (isRootLeadSession(doc) || !isAgentOnlySession(doc)) return null;
+  return { id, parentIds: agentParentIds({ ...doc, id }), lastActive: subAgentActivityAt(doc) };
+}
+
+/** The members grouped into trees: members joined by any owner/parent link
+ *  between them (a link to a non-member joins nothing), each tree listing a
+ *  top member (no member parent) first and its members below in link order. */
+export function subAgentTrees(members) {
+  const byId = new Map(members.map((member) => [member.id, member]));
+  const links = new Map(members.map((member) => [member.id, new Set()]));
+  const hasMemberParent = new Set();
+  for (const member of members) {
+    for (const parent of (member.parentIds || []).filter((parentId) => byId.has(parentId))) {
+      links.get(member.id).add(parent);
+      links.get(parent).add(member.id);
+      hasMemberParent.add(member.id);
+    }
+  }
+  const seen = new Set();
+  const trees = [];
+  for (const start of [...members.filter((m) => !hasMemberParent.has(m.id)), ...members]) {
+    if (seen.has(start.id)) continue;
+    const tree = [start];
+    seen.add(start.id);
+    for (let index = 0; index < tree.length; index++) {
+      for (const id of links.get(tree[index].id)) {
+        if (seen.has(id)) continue;
+        seen.add(id);
+        tree.push(byId.get(id));
+      }
+    }
+    trees.push(tree);
+  }
+  return trees;
+}
+
+/** The stored activity time of `id` now; null when its record cannot be read. */
+function storedActivityAt(id) {
+  const path = sessionPath(id);
+  const probe = probePath(path);
+  if (probe.state !== PROBE_PRESENT) return null;
+  const record = readSweepRecord(id, path, probe);
+  return record?.id === id ? subAgentActivityAt(record.doc) : null;
+}
+
+/**
+ * Archives or deletes each idle tree. A tree with a member running here
+ * (`isSessionLive`), or one whose stored activity moved since the sweep read
+ * it, is left alone. An archive goes through the desktop's archive flag
+ * (`setSidebar(id, SUB_AGENT_AUTO_ARCHIVE)`: exactly the members not yet
+ * archived, never a cascade past them — needs
+ * `isArchived`, the desktop's flags); a deleted member that was archived loses
+ * its flag (`{ forgotten: true }`). Returns `{ archived, deleted }` (ids).
+ */
+export async function applySubAgentRetention(
+  members,
+  { isSessionLive = null, isArchived = null, setSidebar = null, now = Date.now() } = {}
+) {
+  const archived = [];
+  const deleted = [];
+  for (const tree of subAgentTrees(members)) {
+    // A member of unknown age (no valid stored timestamp) keeps its tree.
+    if (!tree.every((member) => Number.isFinite(member.lastActive) && member.lastActive > 0)) continue;
+    const idle = now - Math.max(...tree.map((member) => member.lastActive));
+    const expired = idle >= SUB_AGENT_DELETE_AFTER_MS;
+    if (!expired && (idle < SUB_AGENT_ARCHIVE_AFTER_MS || !isArchived)) continue;
+    if (tree.some((member) => isSessionLive?.(member.id))) continue;
+    if (tree.some((member) => storedActivityAt(member.id) !== member.lastActive)) continue;
+    if (expired) {
+      for (const { id } of tree.toReversed()) {
+        try {
+          if (deleteSession(id, { deferSummaryUpdate: true, isSessionLive, legacyOwnerVeto: true })) deleted.push(id);
+        } catch {
+          /* kept; the next pass decides again */
+        }
+      }
+      continue;
+    }
+    for (const { id } of tree) {
+      if (isArchived(id)) continue;
+      try {
+        await setSidebar(id, SUB_AGENT_AUTO_ARCHIVE);
+        archived.push(id);
+      } catch {
+        /* not archived; the next pass decides again */
+      }
+    }
+  }
+  if (deleted.length) _queueSummaryIndexPrune(new Set(deleted));
+  for (const id of deleted) {
+    if (!isArchived?.(id)) continue;
+    try {
+      await setSidebar(id, { forgotten: true });
+    } catch {
+      /* a stale archive stamp hides nothing */
+    }
+  }
+  return { archived, deleted };
+}

package/src/runtime/agent/orchestrator/session/store/sweep/sweep-plan.mjs

@@ -26,6 +26,9 @@ export function resolveSweepPlan(ttlMs, options = {}) {
     retainOpen: sweepIdle && options.retainOpenSessions !== false,
     openMaxAgeMs: Number.isFinite(optAge) && optAge > 0 ? optAge : RESUMABLE_OPEN_MAX_AGE_MS,
     openMaxCount: Number.isFinite(optCount) && optCount >= 0 ? optCount : RESUMABLE_OPEN_MAX_COUNT,
+    // Name every sub-agent session for the tree retention its caller applies
+    // (sweep/sub-agent-retention.mjs). Idle sweep only.
+    retainSubAgents: sweepIdle && options.retainSubAgents === true,
   };
 }
 
@@ -69,5 +72,7 @@ export function createSweepTally() {
     openCandidates: [],
     openPruned: 0,
     openPrunedDetails: [],
+    // Sub-agent sessions with their stored activity (plan.retainSubAgents).
+    subAgents: [],
   };
 }

package/src/runtime/agent/orchestrator/session/store/sweep/sweep-record.mjs

@@ -4,7 +4,7 @@
 // idle / retention / blank-scratch thresholds.
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { writeJsonAtomicSync } from '../../../../../shared/atomic-file.mjs';
+import { holdsNoData, writeJsonAtomicSync } from '../../../../../shared/atomic-file.mjs';
 import { getPluginData } from '../../../config.mjs';
 import { readTopLevelLifecycleRecord, isLifecycleUnreadable } from '../../lifecycle-scan.mjs';
 
@@ -48,7 +48,7 @@ export const BLANK_SCRATCH_MAX_AGE_MS = 60 * 60 * 1000; // 1h
 // running is still parsed again.
 const sweepRecordCache = new Map();
 const SWEEP_RECORD_CACHE_FILE = 'session-sweep-records.json';
-const SWEEP_RECORD_CACHE_VERSION = 2;
+const SWEEP_RECORD_CACHE_VERSION = 3;
 let sweepRecordCacheDataDir = null;
 let sweepRecordCacheDirty = false;
 let sweepRecordParses = 0;
@@ -82,7 +82,7 @@ function syncSweepRecordCache() {
 }
 
 // The only document fields sweep-row reads (effectiveFields, the closed
-// check). Caching the whole top-level document kept
+// check, the sub-agent retention verdict). Caching the whole top-level document kept
 // every session's tool catalogs, schemas and provider state alive — one
 // entry per session file, measured at ~290MB of a 470MB daemon heap.
 const SWEEP_DOC_FIELDS = [
@@ -97,6 +97,11 @@ const SWEEP_DOC_FIELDS = [
   'createdAt',
   'ownerSessionId',
   'parentSessionId',
+  'lastUsedAt',
+  'agent',
+  'visibility',
+  'sessionVisibility',
+  'taskOrigin',
 ];
 
 function conversationCountOf(doc) {
@@ -108,8 +113,12 @@ function conversationCountOf(doc) {
   return count;
 }
 
-/** `null` when the file could not be read; otherwise the lifecycle record
- * (possibly LIFECYCLE_SCAN_CONFLICT, which is never cached). */
+/** The file holds no data (empty or NUL-filled by a crash); never cached. */
+export const SWEEP_RECORD_NO_DATA = Symbol('sweep-record-no-data');
+
+/** `null` when the file could not be read; SWEEP_RECORD_NO_DATA for a file
+ * without data; otherwise the lifecycle record (possibly
+ * LIFECYCLE_SCAN_CONFLICT, which is never cached). */
 export function readSweepRecord(id, jsonPath, probe) {
   syncSweepRecordCache();
   const cached = sweepRecordCache.get(id);
@@ -121,6 +130,7 @@ export function readSweepRecord(id, jsonPath, probe) {
   } catch {
     return null;
   }
+  if (holdsNoData(raw)) return SWEEP_RECORD_NO_DATA;
   sweepRecordParses++;
   const full = readTopLevelLifecycleRecord(raw);
   if (isLifecycleUnreadable(full)) return full;

package/src/runtime/agent/orchestrator/session/store/sweep/sweep-row.mjs

@@ -12,7 +12,8 @@ import { probePath, PROBE_PRESENT, PROBE_ABSENT } from '../fs-probe.mjs';
 import { _queueSessionSummaryUpsert, _queueSessionSummaryRemoval } from '../summary-cache.mjs';
 import { deleteSession } from '../session-delete.mjs';
 import { markSessionClosed } from '../lifecycle-barriers.mjs';
-import { BLANK_SCRATCH_MAX_AGE_MS, RUNNING_STALL_MS, readSweepRecord } from './sweep-record.mjs';
+import { BLANK_SCRATCH_MAX_AGE_MS, RUNNING_STALL_MS, SWEEP_RECORD_NO_DATA, readSweepRecord } from './sweep-record.mjs';
+import { subAgentMember } from './sub-agent-retention.mjs';
 import { isAgentHomeSessionId } from '../../agent-home.mjs';
 import { isRoomThreadSessionId } from '../../agent-room.mjs';
 
@@ -28,6 +29,14 @@ const effectiveFields = (actual, row) => ({
   createdAt: Number(actual?.createdAt) > 0 ? Number(actual.createdAt) : row.createdAt || 0,
 });
 
+/** Every sub-agent record, open or closed, fresh or not, for the tree
+ *  retention its caller applies (sub-agent-retention.mjs). */
+function noteSubAgent(ctx, id, doc) {
+  if (!ctx.plan.retainSubAgents) return;
+  const member = subAgentMember(id, doc);
+  if (member) ctx.tally.subAgents.push(member);
+}
+
 /** A closed record: a mature tombstone is deleted; otherwise a stale summary
  *  row that still claims the session open is repaired and the row is kept. */
 function sweepClosedRecord(ctx, row, actual, jsonPath) {
@@ -153,6 +162,7 @@ function sweepOpenRecord(ctx, row, record, { jsonMtime }) {
     tally.remaining++;
     return;
   }
+  noteSubAgent(ctx, row.id, record.doc);
   const eff = effectiveFields(record.doc, row);
   const ownerNamed = typeof eff.owner === 'string' && eff.owner.length > 0;
   // Freshness gate — recently-touched open sessions are skipped cheaply here.
@@ -204,6 +214,37 @@ function sweepOpenRecord(ctx, row, record, { jsonMtime }) {
   tally.remaining++;
 }
 
+/** A record a crash left empty or NUL-filled holds nothing to preserve and
+ *  would otherwise be reported forever as an unreadable session: its bytes are
+ *  kept aside as `<id>.json.corrupt-<ts>` (deleteSession, under the commit
+ *  lock and its liveness vetoes) and the session's row is retired with it. */
+function sweepNoDataRecord(ctx, row) {
+  const { plan, tally } = ctx;
+  if (plan.isSessionLive?.(row.id)) {
+    tally.remaining++;
+    return;
+  }
+  try {
+    if (
+      deleteSession(row.id, {
+        deferSummaryUpdate: true,
+        isSessionLive: plan.isSessionLive,
+        legacyOwnerVeto: true,
+        // The no-data verdict predates the commit lock: a record repaired or
+        // republished since is valid content and must survive.
+        damagedOnly: true,
+      })
+    ) {
+      tally.openPruned++;
+      tally.openPrunedDetails.push({ id: row.id, ageSeconds: 0 });
+      return;
+    }
+  } catch {
+    /* keep the row on failure */
+  }
+  tally.remaining++;
+}
+
 export function sweepRow(ctx, row) {
   if (!row?.id) return;
   const { tally } = ctx;
@@ -230,6 +271,10 @@ export function sweepRow(ctx, row) {
   // unreadable record, or a record naming another id (including a foreign
   // TOMBSTONE that would look perfectly mature) is preserved untouched.
   const record = readSweepRecord(row.id, jsonPath, jsonProbe);
+  if (record === SWEEP_RECORD_NO_DATA) {
+    sweepNoDataRecord(ctx, row);
+    return;
+  }
   if (record === null || isLifecycleUnreadable(record) || record.id !== row.id) {
     tally.remaining++;
     return;
@@ -242,7 +287,10 @@ export function sweepRow(ctx, row) {
     return;
   }
   if (record.closed === true || actual.status === 'closed') {
+    const cleanedBefore = ctx.tally.tombstonesCleaned;
     sweepClosedRecord(ctx, row, actual, jsonPath);
+    // A tombstone this sweep just deleted is gone, not a member.
+    if (ctx.tally.tombstonesCleaned === cleanedBefore) noteSubAgent(ctx, row.id, actual);
     return;
   }
   sweepOpenRecord(ctx, row, record, { jsonMtime: jsonProbe.mtimeMs || 0 });

package/src/runtime/agent/orchestrator/session/store-summary-catalog.mjs

@@ -12,6 +12,7 @@
 import { readdirSync, readFileSync } from 'node:fs';
 import { stat } from 'node:fs/promises';
 import { join } from 'node:path';
+import { performance } from 'node:perf_hooks';
 // Leaf helpers only: the three-way present/absent/unreadable classification
 // and the strict record parser the authoritative store uses, so the catalog
 // cannot disagree with it.
@@ -22,7 +23,7 @@ import { isAgentOnlySession, isRootLeadSession, sessionVisibility } from './stor
 import { applySummaryLogText, summaryLogPath } from './store-summary-log.mjs';
 import { dataDir } from './store-summary-locations.mjs';
 import { normalizeRoutineProvenance } from './routine-result.mjs';
-import { lastMessageLine, lastMessageSummary } from './store-summary-last-message.mjs';
+import { lastMessageLine, lastMessageSummary, normalizedIncomingTail } from './store-summary-last-message.mjs';
 import {
   desktopSession,
   importKey,
@@ -211,6 +212,9 @@ export function normalizedRow(row) {
     permission: row.permission || null,
     toolPermission: row.toolPermission || null,
     messageCount: Math.max(0, Math.floor(Number(row.messageCount) || 0)),
+    // Absent from a row read off a session file: its assistant text is not
+    // decoded there, so the unread count falls back until the next save.
+    ...(Array.isArray(row.incomingTail) ? { incomingTail: normalizedIncomingTail(row.incomingTail) } : {}),
     realTurnCount: realTurnCount(row),
     title: cleanText(row.title, 100),
     preview: cleanText(row.preview),
@@ -381,6 +385,66 @@ function scanSessionEntries(directory, indexRowsById, forceRead) {
   return { entries };
 }
 
+// The async rescan yields a turn once a slice of reconciles has run this long:
+// a full authoritative rescan strict-reads every session file (≈4 s for 1.8k
+// files / 1.3 GB), which must not hold the daemon loop in one piece.
+let scanSliceMs = 25;
+
+/** Test seam: the async rescan's slice budget (0 yields after every file). */
+export function _setCatalogScanSliceMsForTest(ms) {
+  scanSliceMs = Math.max(0, Number(ms) || 0);
+}
+
+const nextTurn = () => new Promise((resolve) => setImmediate(resolve));
+
+/** The entry a file still has: `entry` when the file's stamp is unchanged
+ *  since it was reconciled, else a fresh reconcile (null once it is gone). */
+function settledEntry(directory, storageId, entry, retained, forceRead) {
+  if (entry?.stamp) {
+    let stamp = null;
+    try {
+      stamp = statSessionStamp(join(directory, `${storageId}.json`));
+    } catch {
+      // Gone or unstatable: the reconcile below decides which.
+    }
+    if (stamp && sameSessionStamp(entry.stamp, stamp)) return entry;
+  }
+  return reconcileSessionFile(directory, storageId, retained, forceRead);
+}
+
+/** scanSessionEntries in slices, yielding the loop between them. Files can
+ *  change while it yields, so the answer is settled in one synchronous pass at
+ *  the end: the directory is listed again, a file whose stamp moved since its
+ *  read (or that appeared) is reconciled again, and a file that is no longer
+ *  listed is dropped — the entries match storage when they are returned, as
+ *  the one-piece scan's do. That pass is a stat per file (≈20 ms for 1.5k). */
+async function scanSessionEntriesAsync(directory, indexRowsById, forceRead, onSettle) {
+  const sessionIds = listSessionIds(directory);
+  if (!sessionIds) {
+    onSettle?.();
+    return null;
+  }
+  const scanned = new Map();
+  let sliceStart = performance.now();
+  for (const storageId of sessionIds) {
+    if (performance.now() - sliceStart >= scanSliceMs) {
+      await nextTurn();
+      sliceStart = performance.now();
+    }
+    const entry = reconcileSessionFile(directory, storageId, indexRowsById.get(storageId), forceRead);
+    if (entry) scanned.set(storageId, entry);
+  }
+  onSettle?.();
+  const settledIds = listSessionIds(directory);
+  if (!settledIds) return null;
+  const entries = new Map();
+  for (const storageId of settledIds) {
+    const entry = settledEntry(directory, storageId, scanned.get(storageId), indexRowsById.get(storageId), forceRead);
+    if (entry) entries.set(storageId, entry);
+  }
+  return { entries };
+}
+
 /** The row an entry contributes, or null. */
 function entryRow(entry, id, indexRowsById) {
   if (!entry || entry.kind === 'none') return null;
@@ -416,6 +480,21 @@ export function scanSessionFiles(indexRowsById, forceRead) {
   return scan && assembleCatalog(scan.entries, indexRowsById);
 }
 
+/** scanSessionFiles with the same answer, its file reconciles run in slices
+ *  that yield the event loop (the daemon's session.list storage refresh).
+ *  `onSettle` runs once, when the answer's final synchronous part begins: from
+ *  then on storage changes are no longer seen by this scan. */
+export async function scanSessionFilesAsync(indexRowsById, forceRead, { onSettle } = {}) {
+  const directory = join(dataDir(), 'sessions');
+  const dirProbe = probePath(directory);
+  if (dirProbe.state !== PROBE_PRESENT) {
+    onSettle?.();
+    return dirProbe.state === PROBE_ABSENT ? [] : null;
+  }
+  const scan = await scanSessionEntriesAsync(directory, indexRowsById, forceRead, onSettle);
+  return scan && assembleCatalog(scan.entries, indexRowsById);
+}
+
 /** Listing from the index rows alone, or null without a valid index. */
 export function indexListing(index) {
   return index.rows && leadRows(index.rows.map((row) => ({ ...row }))).sort(byCatalogOrder);

package/src/runtime/agent/orchestrator/session/store-summary-index.mjs

@@ -29,7 +29,15 @@ import {
 } from './store-summary-fields.mjs';
 import { isRealTurnMessage } from './compact/user-message-kind.mjs';
 import { isRoutineResultMessage, normalizeRoutineProvenance, routineProvenance } from './routine-result.mjs';
-import { LAST_MESSAGE_PREVIEW_MAX, cleanSummaryPreview, lastMessageRawText } from './store-summary-last-message.mjs';
+import {
+  INCOMING_TAIL_MAX,
+  LAST_MESSAGE_PREVIEW_MAX,
+  cleanSummaryPreview,
+  isIncomingKind,
+  normalizedIncomingTail,
+  lastMessageRawText,
+  wantsIncomingTail,
+} from './store-summary-last-message.mjs';
 
 export const SESSION_SUMMARY_INDEX_VERSION = 2;
 
@@ -111,6 +119,13 @@ function _sessionMessageProjection(session) {
   let real = 0;
   let preview = '';
   let previewMessage = null;
+  // Where the incoming messages with text sit among the counted ones (see
+  // incomingTailOf), kept only for the threads that show an unread count.
+  const wantsIncoming = wantsIncomingTail(session?.id);
+  let incoming = [];
+  // The totals ahead of the newest message, which a streamed reply fills in
+  // place after it was counted: an append redoes that message from here.
+  let ahead = null;
   const canAppend =
     cached &&
     messages.length >= cached.length &&
@@ -119,6 +134,12 @@ function _sessionMessageProjection(session) {
     start = cached.length;
     count = cached.count;
     real = cached.real;
+    incoming = cached.incoming.slice();
+    if (cached.ahead) {
+      start = cached.length - 1;
+      ({ count, real } = cached.ahead);
+      incoming = cached.ahead.incoming.slice();
+    }
     preview = cached.preview;
     previewMessage = cached.previewMessage;
     // The first real user message is stable in normal append-only session
@@ -131,6 +152,7 @@ function _sessionMessageProjection(session) {
         start = 0;
         count = 0;
         real = 0;
+        incoming = [];
         preview = '';
         previewMessage = null;
       }
@@ -138,7 +160,14 @@ function _sessionMessageProjection(session) {
   }
   for (let index = start; index < messages.length; index += 1) {
     const message = messages[index];
-    if (message && (message.role === 'user' || message.role === 'assistant')) count += 1;
+    if (index === messages.length - 1) ahead = { count, real, incoming: incoming.slice() };
+    if (message && (message.role === 'user' || message.role === 'assistant')) {
+      count += 1;
+      if (wantsIncoming && isIncomingKind(message) && _lastPreviewFromMessage(message)) {
+        incoming.push(count);
+        if (incoming.length > INCOMING_TAIL_MAX) incoming.shift();
+      }
+    }
     if (isRealTurnMessage(message)) real += 1;
     if (!preview) {
       const candidate = _previewFromMessage(message);
@@ -165,11 +194,13 @@ function _sessionMessageProjection(session) {
       lastMessage: messages[messages.length - 1] || null,
       count,
       real,
+      incoming,
+      ahead,
       preview,
       previewMessage,
     });
   }
-  return { count, real, preview, last, lastRoutine };
+  return { count, real, incoming: wantsIncoming ? incoming : null, preview, last, lastRoutine };
 }
 
 function _desktopSessionSummary(value, cwd = null) {
@@ -233,6 +264,7 @@ export function _sessionSummary(session) {
       : null,
     taskType: session.taskType || null,
     messageCount: messageProjection.count,
+    ...(messageProjection.incoming ? { incomingTail: messageProjection.incoming.slice() } : {}),
     realTurnCount: messageProjection.real,
     title: _cleanPreview(session.title || '', 100),
     preview: messageProjection.preview,
@@ -291,6 +323,7 @@ function _normalizeSummaryRow(row) {
       : null,
     taskType: row.taskType || null,
     messageCount: Math.max(0, Math.floor(Number(row.messageCount) || 0)),
+    ...(Array.isArray(row.incomingTail) ? { incomingTail: normalizedIncomingTail(row.incomingTail) } : {}),
     realTurnCount: realTurnCount(row),
     title: _cleanPreview(row.title || '', 100),
     preview: _cleanPreview(row.preview || ''),
@@ -561,12 +594,14 @@ export function summaryLockFailureStats() {
 
 // ── Stale temp sweep ────────────────────────────────────────────────────────
 // A crash between an atomic write's temp file and its rename orphans
-// `.session-summaries.json.<24 hex>.tmp` (multi-MB each). Only this store's
+// `session-summaries.json.mixdog-tmp-<16 hex>` (multi-MB each; before the
+// cloud-sync fix `.session-summaries.json.<24 hex>.tmp`). Only this store's
 // pattern is touched. Deleted only when older than SUMMARY_TMP_MIN_AGE_MS and
 // while holding the index lock: every writer of these temps (full rewrite,
 // compaction) holds that lock for the whole write, so no live writer can own a
 // temp file the sweep sees.
-const SUMMARY_TMP_PATTERN = /^\.session-summaries\.json\.[0-9a-f]{24}\.tmp$/;
+const SUMMARY_TMP_PATTERN =
+  /^(?:\.session-summaries\.json\.[0-9a-f]{24}\.tmp|session-summaries\.json\.mixdog-tmp-[0-9a-f]{16,24})$/;
 const SUMMARY_TMP_MIN_AGE_MS = 10 * 60 * 1000;
 let _sweptSummaryDir = '';