mixdog 1.3.1 → 1.3.3

package/src/runtime/agent/orchestrator/providers/registry.mjs

@@ -509,6 +509,25 @@ export function providerInputExcludesCache(name) {
 export function providerNativePdf(name) {
   return providerTakesNativePdf(providers.get(String(name || '').toLowerCase()));
 }
+/**
+ * Whether the named provider sends image input to its models: false only for
+ * an adapter that declares `takesImages = false` (the text-only local
+ * runtime, which lowers every image to a placeholder). A pure lookup; an
+ * unknown provider is treated as taking images, as attachments are.
+ */
+export function providerReadsImages(name) {
+  return providers.get(String(name || '').toLowerCase())?.takesImages !== false;
+}
+/**
+ * The user's image-input override for one model of a custom provider: true or
+ * false as set, undefined when unset (auto) or the provider is not a loaded
+ * custom one. A pure lookup; it never instantiates a provider.
+ */
+export function providerModelVisionOverride(name, model) {
+  const overrides = providers.get(String(name || '').toLowerCase())?.customConfig?.modelOverrides;
+  const value = overrides && Object.hasOwn(overrides, model) ? overrides[model]?.supportsVision : undefined;
+  return typeof value === 'boolean' ? value : undefined;
+}
 /**
  * Whether the named provider's adapter declares `consumesReadWindows`: it
  * needs the structured clip report of read results. A pure lookup; a proxy

package/src/runtime/agent/orchestrator/providers/wire-gateway.mjs

@@ -9,7 +9,7 @@ import { OpenAICompatProvider, OPENAI_COMPAT_PRESETS } from './openai-compat.mjs
 import { originBoundFetch } from './lib/origin-bound-fetch.mjs';
 import { withInclusiveUsage } from './lib/inclusive-usage.mjs';
 import { getModelMetadataSync } from './model-catalog.mjs';
-import { resolveWireRoute, sendOnRoute } from './wire-route.mjs';
+import { resolveWireRoute, sendOnRoute, sendWireRoute } from './wire-route.mjs';
 
 // A Files API file-ID image anywhere in the history (tool results nest content).
 function hasFileIdImage(value, depth = 0) {
@@ -66,6 +66,10 @@ export class GatewayMessagesEngine extends AnthropicProvider {
   _sendOnce(messages, model, tools, opts) {
     return super._sendOnce(messages, model, tools, gatewayMessagesOpts(this.config, model, messages, opts));
   }
+  // Same ceiling a send resolves, so a retry never asks above the gateway's limit.
+  escalatedMaxTokens(model, opts) {
+    return super.escalatedMaxTokens(model, gatewayMessagesOpts(this.config, model, [], opts));
+  }
   _createClient(apiKey) {
     const client = super._createClient(apiKey);
     if (this.config.authScheme === 'bearer') {
@@ -138,6 +142,14 @@ export class WireGatewayProvider {
     });
   }
 
+  // A higher one-shot max_tokens exists only on the Messages wire; the
+  // route is the same one the send itself resolves. Other wires: null.
+  async escalatedMaxTokens(model, opts, tools) {
+    const useModel = model || this.openai.defaultModel;
+    const route = await sendWireRoute(this, useModel, tools, opts);
+    return route?.wire === 'messages' ? this.anthropic.escalatedMaxTokens(useModel, opts) : null;
+  }
+
   reloadApiKey() {
     this.openai.reloadApiKey();
     this.anthropic.reloadApiKey();

package/src/runtime/agent/orchestrator/runtime-core/config-helpers.mjs

@@ -4,6 +4,7 @@ import { clean, hasOwn } from './session-text.mjs';
 import { normalizeEffortInput, normalizeSavedEffort } from './effort.mjs';
 import { routeFastKey, fastPreferenceFor } from './model-capabilities.mjs';
 import { normalizeContextTokens } from '../../../shared/llm/default-context-window.mjs';
+import { normalizeCompactionSummaryMode } from '../session/compact/summary-mode.mjs';
 
 const DEFAULT_PROVIDER = 'anthropic-oauth';
 export const DEFAULT_MODEL = '';
@@ -191,12 +192,23 @@ const AUTO_CLEAR_DEFAULT_IDLE_MS = 60 * 60 * 1000;
 // reusable. Gemini, xAI and Mistral
 // caches run ~1h, Groq's implicit cache persists ~2h, and DeepSeek's
 // implicit cache is evicted after "a few hours to a few days" (kept at 24h).
-// OpenAI (direct and OAuth/Codex) guarantees a 30-minute minimum prompt-cache
-// TTL on GPT-5.6+ (refreshed on use; no 24h retention there), so the sweep
-// matches that window. Older OpenAI models that still take
-// prompt_cache_retention='24h' are not distinguished: these call sites only
-// know the provider, not the model, so 30m applies to the whole provider.
+// OpenAI public API (GPT-5.6+ Responses, cache-strategy.mjs): the moving tail
+// is written with ttl "30m" and only the Lead-class stable prefix with "12h",
+// so the sweep matches the 30m tail — a clear after that costs nothing extra
+// (the tail is cold anyway) and the cleared session restarts on the warm 12h
+// prefix. Earlier OpenAI models (prompt_cache_retention, typically ~30 min)
+// are not distinguished: these call sites only know the provider.
+// OpenAI OAuth (Codex/ChatGPT login) keeps the cache of logged-in users
+// indefinitely (2026-10-20), so its built-in window is unlimited: no idle
+// clear; compaction happens only at the context limit or on request.
 // Unknown/unrecognized providers fall back to the 'default' 1h entry.
+//
+// Unlimited ("never auto-clear") is stored as 0 in providerIdleMs — a value
+// older builds dropped, so no older config carries it — and resolves to
+// AUTO_CLEAR_UNLIMITED_MS, which every idle comparison treats as never
+// reached. Input also accepts 'unlimited' / 'never'.
+export const AUTO_CLEAR_UNLIMITED = 0;
+export const AUTO_CLEAR_UNLIMITED_MS = Number.MAX_SAFE_INTEGER;
 const AUTO_CLEAR_PROVIDER_IDLE_MS = Object.freeze({
   anthropic: 60 * 60 * 1000,
   'anthropic-oauth': 60 * 60 * 1000,
@@ -205,20 +217,48 @@ const AUTO_CLEAR_PROVIDER_IDLE_MS = Object.freeze({
   openai: 30 * 60 * 1000,
   deepseek: 24 * 60 * 60 * 1000,
   xai: 60 * 60 * 1000,
-  'openai-oauth': 30 * 60 * 1000,
+  'openai-oauth': AUTO_CLEAR_UNLIMITED,
   mistral: 60 * 60 * 1000,
   default: AUTO_CLEAR_DEFAULT_IDLE_MS,
 });
 const AUTO_CLEAR_PROVIDER_IDS = Object.freeze(Object.keys(AUTO_CLEAR_PROVIDER_IDLE_MS));
 
+// Completed-agent retention where it must differ from the idle window. Reap
+// frees in-memory sessions and worker-index rows (resources), so it stays
+// finite even where the cache is permanent: openai-oauth uses the 1h product
+// default, which covers Lead follow-ups (24/25 Lead waits were 5–27 min).
+const AGENT_TERMINAL_REAP_MS = Object.freeze({ 'openai-oauth': 60 * 60 * 1000 });
+
+/** A stored/requested idle value: AUTO_CLEAR_UNLIMITED, a window ≥ 1 min, or
+ *  null when absent or invalid. */
+export function normalizeAutoClearIdleValue(value) {
+  if (value === null || value === undefined || typeof value === 'boolean') return null;
+  if (typeof value === 'string') {
+    const text = value.trim().toLowerCase();
+    if (!text) return null;
+    if (text === 'unlimited' || text === 'never') return AUTO_CLEAR_UNLIMITED;
+  }
+  const idleMs = Number(value);
+  if (!Number.isFinite(idleMs) || idleMs < 0) return null;
+  if (idleMs === 0) return AUTO_CLEAR_UNLIMITED;
+  return Math.max(60_000, Math.round(idleMs));
+}
+
+const resolvedIdleMs = (stored) => (stored === AUTO_CLEAR_UNLIMITED ? AUTO_CLEAR_UNLIMITED_MS : stored);
+
+/** Whether a resolved idle window means "never auto-clear". */
+export function isAutoClearUnlimited(idleMs) {
+  return Number(idleMs) >= AUTO_CLEAR_UNLIMITED_MS;
+}
+
 function normalizeAutoClearProviderIdleMs(value = {}) {
   const raw = value && typeof value === 'object' ? value : {};
   const out = {};
   for (const [key, ms] of Object.entries(raw)) {
     const provider = clean(key).toLowerCase();
-    const idleMs = Number(ms);
-    if (!provider || !Number.isFinite(idleMs) || idleMs <= 0) continue;
-    out[provider] = Math.max(60_000, Math.round(idleMs));
+    const idleMs = normalizeAutoClearIdleValue(ms);
+    if (!provider || idleMs === null) continue;
+    out[provider] = idleMs;
   }
   return out;
 }
@@ -228,49 +268,71 @@ function normalizeAutoClearProviderIdleMs(value = {}) {
 export function autoClearIdleMsForProvider(provider, providerIdleMs = null) {
   const overrides = normalizeAutoClearProviderIdleMs(providerIdleMs);
   const key = clean(provider).toLowerCase();
-  if (overrides[key]) return overrides[key];
-  if (key && AUTO_CLEAR_PROVIDER_IDLE_MS[key]) return AUTO_CLEAR_PROVIDER_IDLE_MS[key];
-  if (overrides.default) return overrides.default;
+  if (key && Object.hasOwn(overrides, key)) return resolvedIdleMs(overrides[key]);
+  if (key && Object.hasOwn(AUTO_CLEAR_PROVIDER_IDLE_MS, key)) return resolvedIdleMs(AUTO_CLEAR_PROVIDER_IDLE_MS[key]);
+  if (Object.hasOwn(overrides, 'default')) return resolvedIdleMs(overrides.default);
   return AUTO_CLEAR_PROVIDER_IDLE_MS.default;
 }
 
-export function autoClearProviderDefaults(providerIdleMs = null) {
+// One row per built-in provider plus every provider in `extraProviders` (the
+// providers the user has enabled or routes to), before the 'default' row.
+// A provider without a built-in entry resolves like any unknown provider.
+export function autoClearProviderDefaults(providerIdleMs = null, extraProviders = []) {
   const overrides = normalizeAutoClearProviderIdleMs(providerIdleMs);
-  return AUTO_CLEAR_PROVIDER_IDS.map((provider) => {
-    const builtInMs = AUTO_CLEAR_PROVIDER_IDLE_MS[provider] ?? AUTO_CLEAR_PROVIDER_IDLE_MS.default;
-    const idleMs = overrides[provider] ?? builtInMs;
+  const ids = AUTO_CLEAR_PROVIDER_IDS.filter((id) => id !== 'default');
+  for (const value of extraProviders || []) {
+    const id = clean(value).toLowerCase();
+    if (id && !ids.includes(id) && id !== 'default') ids.push(id);
+  }
+  for (const id of Object.keys(overrides)) if (!ids.includes(id) && id !== 'default') ids.push(id);
+  ids.push('default');
+  return ids.map((provider) => {
+    const builtIn = Object.hasOwn(AUTO_CLEAR_PROVIDER_IDLE_MS, provider)
+      ? AUTO_CLEAR_PROVIDER_IDLE_MS[provider]
+      : AUTO_CLEAR_PROVIDER_IDLE_MS.default;
+    const idleMs = Object.hasOwn(overrides, provider)
+      ? resolvedIdleMs(overrides[provider])
+      : provider === 'default' || Object.hasOwn(AUTO_CLEAR_PROVIDER_IDLE_MS, provider)
+        ? resolvedIdleMs(builtIn)
+        : autoClearIdleMsForProvider(provider, overrides);
     return {
       provider,
       idleMs,
-      builtInMs,
-      custom: overrides[provider] != null,
+      builtInMs: resolvedIdleMs(builtIn),
+      unlimited: isAutoClearUnlimited(idleMs),
+      builtInUnlimited: builtIn === AUTO_CLEAR_UNLIMITED,
+      custom: Object.hasOwn(overrides, provider),
     };
   });
 }
 
 // Agent terminal retention is deliberately narrower than Auto Clear's general
-// resolution: listed providers use their provider cache lifetime. Unlisted
+// resolution: listed providers use their provider cache lifetime, or the
+// finite AGENT_TERMINAL_REAP_MS entry where that cache is permanent. Unlisted
 // providers use the Advanced "default" row, or the built-in default when no
-// override is configured, so completed agents are still eventually reclaimed.
+// override is configured, so completed agents are still eventually reclaimed;
+// an unlimited override never disables reaping.
 export function resolveAgentTerminalReapMs(config, provider) {
   const key = clean(provider).toLowerCase();
   const raw = config?.autoClear && typeof config.autoClear === 'object' ? config.autoClear : {};
   const overrides = normalizeAutoClearProviderIdleMs(raw.providerIdleMs);
+  const finite = (value) => (value > 0 ? value : null);
   if (!key || key === 'default' || !Object.hasOwn(AUTO_CLEAR_PROVIDER_IDLE_MS, key)) {
-    return overrides.default ?? AUTO_CLEAR_PROVIDER_IDLE_MS.default;
+    return finite(overrides.default) ?? AUTO_CLEAR_PROVIDER_IDLE_MS.default;
   }
-  return overrides[key] ?? AUTO_CLEAR_PROVIDER_IDLE_MS[key];
+  return finite(overrides[key]) ?? AGENT_TERMINAL_REAP_MS[key] ?? AUTO_CLEAR_PROVIDER_IDLE_MS[key];
 }
 
 // Resolve the effective auto-clear idle window for a config + provider:
 // a provider-specific override (autoClear.providerIdleMs[provider]) wins;
 // else the global user-set idleMs (autoClear.idleMs); else the provider's
 // built-in window, then providerIdleMs.default / the built-in 1h default.
+// Unlimited resolves to AUTO_CLEAR_UNLIMITED_MS.
 export function resolveAutoClearIdleMs(config, provider) {
   const raw = config?.autoClear && typeof config.autoClear === 'object' ? config.autoClear : {};
   const key = clean(provider).toLowerCase();
-  const providerOverride = key && key !== 'default' ? normalizeAutoClearProviderIdleMs(raw.providerIdleMs)[key] : null;
-  if (providerOverride) return providerOverride;
+  const overrides = normalizeAutoClearProviderIdleMs(raw.providerIdleMs);
+  if (key && key !== 'default' && Object.hasOwn(overrides, key)) return resolvedIdleMs(overrides[key]);
   const idleMs = Number(raw.idleMs);
   if (Number.isFinite(idleMs) && idleMs > 0) return Math.max(60_000, Math.round(idleMs));
   return autoClearIdleMsForProvider(provider, raw.providerIdleMs);
@@ -350,12 +412,16 @@ export function normalizeCompactionConfig(value = {}) {
   delete next.recallConcurrency;
   delete next.recallCycle1DeadlineMs;
   delete next.enabled;
+  delete next.useMaintainer;
   return {
     ...next,
     auto: raw.auto !== false && raw.enabled !== false,
     // Compact a conversation on its current model before switching it to
     // another one in place (default on).
     onModelChange: raw.onModelChange !== false,
+    // Which model writes compaction summaries (smart / maintainer / self);
+    // replaces the previous release's boolean useMaintainer.
+    summaryMode: normalizeCompactionSummaryMode(raw),
   };
 }
 

package/src/runtime/agent/orchestrator/runtime-core/fs-utils.mjs

@@ -1,11 +1,18 @@
 // Small filesystem read helpers used by session-runtime submodules.
 import { readdirSync, readFileSync } from 'node:fs';
+import { holdsNoData } from '../../../shared/atomic-file.mjs';
 
 export { readJsonSafe } from '../../../shared/json-file.mjs';
 
+// The default data dir of a loader factory: a path, or a resolver read per
+// call so a later runtime start's data dir is honored.
+export const defaultDirResolver = (dataDir) => (typeof dataDir === 'function' ? dataDir : () => dataDir);
+
 export function readTextSafe(path) {
   try {
-    return readFileSync(path, 'utf8').trim();
+    const text = readFileSync(path, 'utf8');
+    // A crash can leave NUL bytes (String.trim keeps them): no data is no text.
+    return holdsNoData(text) ? '' : text.trim();
   } catch {
     return '';
   }

package/src/runtime/agent/orchestrator/runtime-core/goal-mutations.mjs

@@ -133,7 +133,7 @@ export function createGoalMutations(ctx) {
     await write(
       join(root, 'history', id, `${assertSessionId(goal.id)}.json`),
       { version: GOAL_FILE_VERSION, goal },
-      { lock: true, secret: true, fsync: false, timeoutMs: 2_000 }
+      { lock: true, secret: true, timeoutMs: 2_000 }
     );
   };
 

package/src/runtime/agent/orchestrator/runtime-core/goal-runtime.mjs

@@ -65,6 +65,10 @@ export function createGoalRuntime({
     // context still owes, from the rules and state already delivered into it.
     // In memory on purpose: a restart is a fresh context that needs them again.
     continuationTiers: new Map(),
+    // Session -> Goal id whose turn ended in a stop (failed, cancelled, usage
+    // limit) the record could not save. The record still reads active, so
+    // without this a full disk would start turn after turn into the same error.
+    unsavedStops: new Map(),
     closed: false,
   };
   Object.assign(ctx, createGoalStore(ctx));
@@ -116,6 +120,7 @@ export function createGoalRuntime({
       ctx.observedGoals.clear();
       ctx.idleReviewTurns.clear();
       ctx.continuationTiers.clear();
+      ctx.unsavedStops.clear();
       listeners.clear();
       // Accepted writes keep their ordering until they settle. Callers may
       // await this barrier before releasing the session's backing resources.

package/src/runtime/agent/orchestrator/runtime-core/goal-storage.mjs

@@ -1,6 +1,13 @@
-import { readFileSync, readdirSync, rmSync, statSync } from 'node:fs';
+import { readdirSync, rmSync, statSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { writeJsonAtomicAsync } from '../../../shared/atomic-file.mjs';
+import {
+  parseJsonText,
+  readJsonStateSync,
+  unsupportedState,
+  withFileLock,
+  writeJsonAtomicAsync,
+} from '../../../shared/atomic-file.mjs';
 import { clean } from '../../../shared/clean.mjs';
 import {
   DEFAULT_COMPLETED_GOAL_TTL_MS,
@@ -87,31 +94,58 @@ export function reportGoalStorageError(error) {
   process.emitWarning(error?.message || String(error), { code: 'GOAL_STORAGE_ERROR' });
 }
 
+// A damaged record (empty, NUL, torn, invalid) never blocks the Goal
+// feature: readJsonStateSync keeps its bytes aside as `<file>.corrupt-<ts>`,
+// restores the last good `.bak` when there is one, else the session has no
+// Goal. A record from a newer build is left in place and reads as no Goal.
+// Real I/O errors still throw.
 function readGoalRecordFile(path, sessionId, normalizeGoal, at) {
+  const record = readJsonStateSync(path, {
+    secret: true,
+    fallback: null,
+    validate(parsed) {
+      if (Number.isSafeInteger(parsed?.version) && parsed.version > GOAL_FILE_VERSION) {
+        throw unsupportedState(`Goal record version ${parsed.version} is newer than this build`);
+      }
+      if (
+        !parsed ||
+        typeof parsed !== 'object' ||
+        !Object.hasOwn(parsed, 'goal') ||
+        parsed.version !== GOAL_FILE_VERSION
+      ) {
+        throw new Error('unsupported or invalid Goal record');
+      }
+      if (parsed.goal !== null && (typeof parsed.goal !== 'object' || Array.isArray(parsed.goal)))
+        throw new Error('invalid Goal value');
+      return { version: GOAL_FILE_VERSION, goal: normalizeGoal(parsed.goal, sessionId, at) };
+    },
+  });
+  return record ?? { version: GOAL_FILE_VERSION, goal: null };
+}
+
+// A record written by a newer build reads as no Goal and stays in place; a
+// write must not replace it (nor, through `.bak`, its backup). Caller holds the
+// record's lock. Unreadable or unparsable content is damage, not a newer build.
+async function refuseNewerRecord(path) {
   let text;
   try {
-    text = readFileSync(path, 'utf8');
+    text = await readFile(path, 'utf8');
   } catch (error) {
-    if (error?.code === 'ENOENT') return { version: GOAL_FILE_VERSION, goal: null };
+    if (error?.code === 'ENOENT') return;
     throw error;
   }
+  let parsed;
   try {
-    const parsed = JSON.parse(text);
-    if (
-      !parsed ||
-      typeof parsed !== 'object' ||
-      !Object.hasOwn(parsed, 'goal') ||
-      parsed.version !== GOAL_FILE_VERSION
-    ) {
-      throw new Error('unsupported or invalid Goal record');
-    }
-    if (parsed.goal !== null && (typeof parsed.goal !== 'object' || Array.isArray(parsed.goal)))
-      throw new Error('invalid Goal value');
-    return { version: GOAL_FILE_VERSION, goal: normalizeGoal(parsed.goal, sessionId, at) };
-  } catch (cause) {
-    throw new Error(
-      `cannot read Goal record ${path}: ${cause.message}; original file preserved, repair or explicitly clear it before creating a Goal`,
-      { cause }
+    parsed = parseJsonText(text);
+  } catch {
+    return;
+  }
+  if (Number.isSafeInteger(parsed?.version) && parsed.version > GOAL_FILE_VERSION) {
+    throw Object.assign(
+      new Error(
+        `Goal record ${path} was written by a newer build (version ${parsed.version} > ${GOAL_FILE_VERSION}); update Mixdog to change this Goal`
+      ),
+      { code: 'EGOALNEWERVERSION' }
     );
   }
 }
@@ -149,7 +183,7 @@ export function createGoalStorage({ pathFor, normalizeGoal, now, writeRecord = w
     try {
       record = readGoalRecordFile(path, id, normalizeGoal, now());
     } catch (error) {
-      if (cached && TRANSIENT_READ_CODES.has(error?.cause?.code ?? error?.code)) {
+      if (cached && TRANSIENT_READ_CODES.has(error?.code)) {
         return structuredClone(cached.record);
       }
       throw error;
@@ -166,7 +200,19 @@ export function createGoalStorage({ pathFor, normalizeGoal, now, writeRecord = w
       const snapshot = structuredClone(record);
       writing.add(id);
       try {
-        await writeRecord(pathFor(id), snapshot, { lock: true, secret: true, fsync: false, timeoutMs: 2_000 });
+        const path = pathFor(id);
+        // The newer-build check and the write share one lock hold, so nothing
+        // can publish a newer record between them. The writer's own lock
+        // request re-enters this hold.
+        await withFileLock(
+          `${path}.lock`,
+          async () => {
+            await refuseNewerRecord(path);
+            // Durable, with the replaced version kept as `.bak` for damage recovery.
+            await writeRecord(path, snapshot, { lock: true, secret: true, backup: true, timeoutMs: 2_000 });
+          },
+          { timeoutMs: 2_000 }
+        );
         // The write lock has already been released. A subsequent stat could
         // belong to another writer, so validate the file on the next read.
         cache.set(id, { record: snapshot, stamp: null });

package/src/runtime/agent/orchestrator/runtime-core/goal-tool-exec.mjs

@@ -112,7 +112,7 @@ const GOAL_TOOL_ACTIONS = {
   status(ctx, id) {
     // Same view the user sees. Reading the stored record here showed the
     // model Goals the user had already archived away.
-    ctx.readRecord(id); // Corruption is an actionable error, not "no Goal".
+    ctx.readRecord(id); // A real I/O error is an actionable error, not "no Goal".
     return toolReply(ctx, id, ctx.visibleSnapshot(id), { full: true });
   },
   async create(ctx, id, args) {

package/src/runtime/agent/orchestrator/runtime-core/goal-turns.mjs

@@ -114,6 +114,7 @@ export function createGoalTurnLifecycle(ctx) {
     turnStartedAt,
     idleReviewTurns,
     continuationTiers,
+    unsavedStops,
     withMutation,
     readRecord,
     commit,
@@ -163,7 +164,14 @@ export function createGoalTurnLifecycle(ctx) {
           applyTurnOutcome(goal, detail, at);
         }
         goal.updatedAt = at;
-        const published = await commit(id, goal);
+        let published;
+        try {
+          published = await commit(id, goal);
+        } catch (error) {
+          if (goal.status !== 'active') unsavedStops.set(id, goal.id);
+          throw error;
+        }
+        unsavedStops.delete(id);
         if (automaticTurnWithoutActivity(detail, published)) idleReviewTurns.set(id, idleReviewKey(published));
         return published;
       });
@@ -189,6 +197,7 @@ export function createGoalTurnLifecycle(ctx) {
       if (goal?.status !== 'active') return { run: false, reason: goal?.status || 'missing', goal };
       if (runningAgentWork(agentStatus)) return { run: false, reason: 'agent-running', goal };
       const id = assertSessionId(sessionId);
+      if (unsavedStops.get(id) === goal.id) return { run: false, reason: 'unsaved-stop', goal };
       const answered = idleReviewTurns.get(id) === idleReviewKey(goal);
       if (settledDurationWait(goal)) {
         // The model already answered this exact list with no new work, so the

package/src/runtime/agent/orchestrator/runtime-core/orchestration.mjs

@@ -25,13 +25,11 @@ export const AGENT_MODE_DELEGATION = `# Delegation
 Handle conversation yourself. Delegate specialised work to sub-agents. Hand
 substantial coding to a new agent task session (\`session create\`) with
 a self-contained brief: start it when already requested, otherwise suggest it. Then relay the
-result in your own words. Work sent to an existing session (\`session send\`)
-reports back only when its result says reportsBack: true; promise to report
-only then.`;
+result in your own words. Promise a follow-up only when the session result allows it.`;
 
-/** Mixy only: it also routes requests to the user's contact agents. */
-export const MIXY_CONTACTS_INTRO = `You also coordinate the user's contact agents: route a request to the
-contact best suited for it with the same kind of brief.`;
+/** Mixy only: the user's other bots, its contact catalog's intro. */
+export const MIXY_CONTACTS_INTRO = `The user's other bots. Hand one a request with \`session send\` to its chat and a
+self-contained brief.`;
 
 export function orchestrationInstructions(value) {
   const mode = normalizeOrchestrationMode(value);

package/src/runtime/agent/orchestrator/runtime-core/route-context-state.mjs

@@ -0,0 +1,81 @@
+// A route's context-window selection against provider windows: the share and
+// window a route names, and what a session is created with for it. Shared by
+// every session builder (spawned agents, hidden-role dispatch, the Lead).
+import { providerCachedModelMetadataSync } from '../providers/provider-catalog-cache.mjs';
+import { contextWindowRange, normalizeContextTokens } from '../../../shared/llm/default-context-window.mjs';
+import { clean } from './session-text.mjs';
+
+// The persisted provider model rows are the SAME source the picker sized its
+// slider against, so they carry both windows (openai-oauth: 272k default /
+// 1M max). Reading them keeps a percentage saved against the picker's scale
+// meaningful; anything that only knows a single window would silently rescale
+// it (30% of 272k instead of 30% of 1M).
+const clampPercent = (percent) => Math.max(10, Math.min(100, percent));
+
+function cachedRouteWindows(provider, model) {
+  const row = providerCachedModelMetadataSync(provider, model)?.rawProviderModel || null;
+  if (!row) return null;
+  const contextWindow = Number(row.contextWindow ?? row.context_window ?? row.max_input_tokens) || 0;
+  const maxContextWindow = Number(row.maxContextWindow ?? row.max_context_window) || 0;
+  return contextWindow > 0 || maxContextWindow > 0 ? { contextWindow, maxContextWindow } : null;
+}
+
+export function resolveRouteContextState(targetRoute = {}, modelMeta = null, windowLookup = cachedRouteWindows) {
+  // Only providers that implement getCachedModelInfo (openai-oauth, cursor,
+  // openai-compat, opencode-go) hand lookupModelMeta a window; every other one
+  // (anthropic-oauth, grok-oauth, gemini, …) gets the bare `{ id, provider }`
+  // placeholder. Reading the window from that alone yields 0, which dropped the
+  // saved context percentage for the entire session — while resolveSessionContextMeta
+  // went on to size that session from the provider/catalog window (Claude Opus 5:
+  // a full 1M rather than the selected 500k). Read the cached provider row here so
+  // the percentage and the session boundary cannot disagree.
+  const windowMeta =
+    Number(modelMeta?.contextWindow) > 0 || Number(modelMeta?.maxContextWindow) > 0
+      ? modelMeta
+      : windowLookup?.(clean(targetRoute?.provider), clean(targetRoute?.model)) || modelMeta;
+  const { defaultWindow, maxWindow } = contextWindowRange({
+    provider: clean(targetRoute?.provider),
+    contextWindow: windowMeta?.contextWindow,
+    maxContextWindow: windowMeta?.maxContextWindow,
+  });
+  if (!maxWindow) {
+    return { contextPercent: undefined, contextDefaultPercent: undefined, selectedContextWindow: undefined };
+  }
+  const contextDefaultPercent = clampPercent(Math.round((defaultWindow / maxWindow) * 10) * 10);
+  // An exact token selection overrides the 10% stops. It is clamped to the
+  // selectable range; one that lands on the default window is the default.
+  const requestedTokens = normalizeContextTokens(targetRoute?.contextTokens);
+  if (requestedTokens) {
+    const contextTokens = Math.max(Math.ceil(maxWindow * 0.1), Math.min(maxWindow, requestedTokens));
+    if (contextTokens === defaultWindow) {
+      return { contextPercent: contextDefaultPercent, contextDefaultPercent, selectedContextWindow: defaultWindow };
+    }
+    const contextPercent = clampPercent(Math.round((contextTokens / maxWindow) * 10) * 10);
+    return { contextPercent, contextDefaultPercent, selectedContextWindow: contextTokens, contextTokens };
+  }
+  const requested = Number(targetRoute?.contextPercent);
+  const contextPercent =
+    Number.isFinite(requested) && requested > 0 ? clampPercent(Math.round(requested / 10) * 10) : contextDefaultPercent;
+  const selectedContextWindow =
+    contextPercent === contextDefaultPercent
+      ? defaultWindow
+      : Math.max(1, Math.floor((maxWindow * contextPercent) / 100));
+  return { contextPercent, contextDefaultPercent, selectedContextWindow };
+}
+
+/**
+ * The session fields (`contextPercent`, `selectedContextWindow`, `contextTokens`)
+ * a route's own context choice creates a session with, from its resolved
+ * `state`. A model whose window is not known resolves to nothing: the choice
+ * then travels as stored (the session sizes it from the provider's window)
+ * instead of being dropped for the model's default. Only set fields are returned.
+ */
+export function contextSelectionFromState(state, route) {
+  const windowKnown = state.contextDefaultPercent !== undefined;
+  const chosen = {
+    contextPercent: state.contextPercent ?? route.contextPercent,
+    selectedContextWindow: state.selectedContextWindow,
+    contextTokens: state.contextTokens ?? (windowKnown ? undefined : route.contextTokens),
+  };
+  return Object.fromEntries(Object.entries(chosen).filter(([, value]) => value));
+}

package/src/runtime/agent/orchestrator/runtime-core/session-text.mjs

@@ -1,6 +1,7 @@
 // Session message/preview text helpers. Pure, no runtime-closure deps.
 import { clean } from '../../../shared/clean.mjs';
 import { stripInjectedBlocks } from '../../../shared/injected-display-text.mjs';
+import { CONTROL_MARKER_RE } from '../../../shared/tool-execution-contract.mjs';
 
 export function sessionMessageText(content) {
   if (content == null) return '';
@@ -42,7 +43,7 @@ function messageContextText(message) {
 const SYNTHETIC_SESSION_TEXT_PATTERNS = Object.freeze([
   /^\[mixdog-runtime\]/i,
   // User-cancel + process-restart control rows must never title/preview a session.
-  /^\[(?:truncated|request interrupted by (?:user(?: for tool use)?|process restart))\]$/i,
+  CONTROL_MARKER_RE,
   /^a previous model worked on this task and produced the compacted handoff summary below\b/i,
   // Compact/auto-clear re-seed handoff variants: these lead the FIRST user
   // message of every post-compaction session, so titling from them painted