mixdog 1.3.4 → 1.4.0

package/src/runtime/agent/orchestrator/session/manager/route-fallback-chain.mjs

@@ -0,0 +1,129 @@
+// The fallback chain a running session follows, read from its settings when
+// it is needed (a hop, a status read) instead of the copy taken at creation:
+// an edit made while the session runs applies from its next model request,
+// and a chain cleared to [] stops further hops at once.
+// - A Lead-class session (coding Lead, a bot's chat, Mixy) follows its
+//   owner's stored route (owner-route-fallbacks.mjs);
+// - a delegated agent follows the route it was spawned from
+//   (`routeFallbackSource`: its agent's route, else Main's, or a named preset).
+// The stored chain applies only while the session's primary — the route it
+// ran on before its first hop — is that stored route's model. A session
+// whose source cannot be read (an older record, a direct route) keeps its own.
+import { findPreset } from '../../runtime-core/config-helpers.mjs';
+import { normalizeWorkflowRoute } from '../../runtime-core/workflow.mjs';
+import { configuredAgentRouteCandidates } from '../../../../shared/agent-route-config.mjs';
+import { CODING_MODE, resolveSessionMode } from '../agent-mode.mjs';
+import { _liveSessions } from '../store/live-state.mjs';
+import { ownerConfiguredRoute, sameRouteModel } from './owner-route-fallbacks.mjs';
+
+const LEAF_FIELDS = ['effort', 'fast', 'autoEffort', 'modelParameters', 'contextPercent', 'contextTokens'];
+
+/** The switchable fields of a route or session record (no chain). */
+export function routeLeaf(route) {
+  const leaf = { provider: route?.provider || '', model: route?.model || '' };
+  for (const key of LEAF_FIELDS) if (route?.[key] !== undefined && route[key] !== null) leaf[key] = route[key];
+  return leaf;
+}
+
+/** The route the session ran on before its first fallback hop; its own route
+ *  while it has not hopped. */
+export function sessionRoutePrimary(session) {
+  if (session?.routeFallbackPrimary?.provider) return session.routeFallbackPrimary;
+  const first = session?.routeFallbackFailures?.[0];
+  if (first?.provider && first?.model) return { provider: first.provider, model: first.model };
+  return routeLeaf(session);
+}
+
+function normalizedOrNull(stored) {
+  if (!stored) return null;
+  try {
+    return normalizeWorkflowRoute(stored) || null;
+  } catch {
+    return null;
+  }
+}
+
+/** The stored route the session's chain comes from, read now; null when the
+ *  session has no readable source (it then keeps its own chain). */
+export function sessionChainSource(session, config) {
+  const { mode, agentId } = resolveSessionMode({ session });
+  if (agentId) return ownerConfiguredRoute({ sessionMode: mode, agentId, config });
+  const source = session?.routeFallbackSource;
+  if (source?.agent) {
+    // As the spawn resolved it: the agent's own route, else Main's.
+    const own = configuredAgentRouteCandidates(config, source.agent).map(normalizedOrNull).find(Boolean);
+    return own || normalizedOrNull(findPreset(config, config?.default));
+  }
+  if (source?.preset) return normalizedOrNull(findPreset(config, source.preset));
+  return null;
+}
+
+/** `{ chain, fromSettings }`: the fallback routes the session follows now. */
+export function liveRouteFallbacks(session, config) {
+  const source = sessionChainSource(session, config);
+  if (!source)
+    return { chain: Array.isArray(session?.routeFallbacks) ? session.routeFallbacks : [], fromSettings: false };
+  const onSourcePrimary = sameRouteModel(source, sessionRoutePrimary(session));
+  return { chain: onSourcePrimary ? source.fallbacks || [] : [], fromSettings: true };
+}
+
+/** Index in `chain` of the next route to try: the first after the session's
+ *  current model that this session has not already run (its primary and the
+ *  models it already left); `chain.length` when none is left. */
+export function nextRouteFallbackIndex(session, chain) {
+  const tried = [sessionRoutePrimary(session), ...(session?.routeFallbackFailures || []), session];
+  const at = chain.findIndex((entry) => sameRouteModel(entry, session));
+  for (let index = at + 1; index < chain.length; index += 1) {
+    if (!tried.some((route) => sameRouteModel(chain[index], route))) return index;
+  }
+  return chain.length;
+}
+
+const modelOf = (route) => ({ provider: route?.provider || '', model: route?.model || '' });
+
+/** The public fallback position of one session: the route it is on against
+ *  its primary, the hop index, the chain it follows now and why it left each model. */
+export function routeFallbackPosition(session, config) {
+  const { chain, fromSettings } = liveRouteFallbacks(session, config);
+  const next = chain[nextRouteFallbackIndex(session, chain)] || null;
+  const primary = sessionRoutePrimary(session);
+  const { mode, agentId } = resolveSessionMode({ session });
+  let kind = 'agent';
+  if (agentId) kind = mode === CODING_MODE ? 'lead' : 'bot';
+  return {
+    sessionId: session.id,
+    kind,
+    agent: agentId || session.agent || null,
+    current: modelOf(session),
+    primary: modelOf(primary),
+    onPrimary: sameRouteModel(primary, session),
+    fallbackIndex: Number(session.routeFallbackIndex) || 0,
+    fallbacks: chain.map(modelOf),
+    chainFrom: fromSettings ? 'settings' : 'session',
+    next: next ? modelOf(next) : null,
+    failures: (session.routeFallbackFailures || []).map(({ provider, model, kind: errorKind, error }) => ({
+      provider,
+      model,
+      kind: errorKind,
+      error,
+    })),
+  };
+}
+
+/** Whether the session has left its primary for a fallback model. */
+export const routeFallbackHopped = (session) =>
+  Number(session?.routeFallbackIndex) > 0 || Boolean(session?.routeFallbackFailures?.length);
+
+/** Positions of the sessions held in this process that follow a chain or have
+ *  hopped; `keep(position)` narrows them. */
+export function liveRouteFallbackPositions(config, keep = () => true) {
+  const rows = [];
+  for (const session of _liveSessions.values()) {
+    // Only a session with an agent hops (advanceAgentRoute).
+    if (!session?.id || session.closed === true || !session.agent) continue;
+    const position = routeFallbackPosition(session, config);
+    if (!position.fallbacks.length && !routeFallbackHopped(session)) continue;
+    if (keep(position)) rows.push(position);
+  }
+  return rows;
+}

package/src/runtime/agent/orchestrator/session/manager/runtime-liveness.mjs

@@ -23,10 +23,12 @@
 // }
 import { createAbortController } from '../../../../shared/abort-controller.mjs';
 import { emitSessionApprovalWaitChange } from '../../../../shared/session-approval-wait.mjs';
-import { emitSessionActivityChange } from '../../../../shared/session-activity-signal.mjs';
+import { emitSessionActivityChange, emitSessionTurnStart } from '../../../../shared/session-activity-signal.mjs';
 import { DEFAULT_ACTIVITY_HEARTBEAT_MS } from '../../stall-policy.mjs';
 import { MODEL_THINKING_STAGE, awaitingModelResponse, lastProgressAt } from '../../../../shared/quiet-progress.mjs';
-import { finishBrowserTurn } from '../../../../browser-bridge/client.mjs';
+import { beginBrowserTurn, finishBrowserTurn, forgetBrowserSession } from '../../../../browser-bridge/client.mjs';
+import { registerSessionPurgeHook } from '../store.mjs';
+import { finishComputerTurn } from '../../../../computer-bridge/client.mjs';
 import { configureUsageMetricsRuntime, dropMetricSeenState, bumpUsageMetricsTurnId } from './usage-metrics.mjs';
 import { runtimeState as _runtimeState, isTurnInFlight } from './runtime-state.mjs';
 
@@ -48,11 +50,25 @@ const VALID_STAGES = new Set([
 ]);
 const TERMINAL_STAGES = new Set(['done', 'error']);
 
+function beginBrowserWork(id, entry) {
+  void beginBrowserTurn(id, entry.browserTurnId).catch((error) => {
+    process.stderr.write(`[browser] Task start failed: ${error?.message || error}\n`);
+  });
+}
+
+// A session deleted for good no longer has browser turns to report.
+registerSessionPurgeHook(forgetBrowserSession);
+
 function finishBrowserWork(id, entry, aborted = false) {
   const turnId = Number(entry.browserTurnId ?? entry.session?.usageMetricsTurnId) || 0;
   void finishBrowserTurn(id, turnId, { aborted }).catch((error) => {
     process.stderr.write(`[browser] Task cleanup failed: ${error?.message || error}\n`);
   });
+  // The same terminal state settles the turn's Computer Use saved-login fills
+  // (lead and sub-agent sessions alike).
+  void finishComputerTurn(id, turnId).catch((error) => {
+    process.stderr.write(`[computer] Turn settlement failed: ${error?.message || error}\n`);
+  });
 }
 
 // Injected deps that would otherwise pull manager.mjs's store/provider surface
@@ -149,6 +165,7 @@ export function markSessionAskStart(id) {
   const sessionForTurn = entry.session ?? _deps.loadSession(id);
   if (sessionForTurn) bumpUsageMetricsTurnId(sessionForTurn);
   entry.browserTurnId = Number(sessionForTurn?.usageMetricsTurnId) || 0;
+  beginBrowserWork(id, entry);
   entry.stage = 'connecting';
   entry.lastStreamDeltaAt = null;
   entry.lastTransportAt = null;
@@ -179,6 +196,7 @@ export function markSessionAskStart(id) {
   entry.lastProgressAt = now;
   entry.updatedAt = now;
   entry.taskWaits = 0;
+  emitSessionTurnStart(id);
   emitSessionActivityChange(id);
 }
 /** The provider put the request on the wire; its response headers are

package/src/runtime/agent/orchestrator/session/manager/session-close.mjs

@@ -24,6 +24,7 @@ import {
 } from './runtime-liveness.mjs';
 import { clearTurnCheckpoint } from './turn-checkpoint.mjs';
 import { forgetSessionSaveBaseline } from '../store/save-worker.mjs';
+import { publishSessionPersistence } from '../store/session-persistence-events.mjs';
 import { forgetSessionLoadCache } from '../store/load-cache.mjs';
 import { releaseReadSnapshotScope } from '../../tools/builtin/snapshot-store.mjs';
 import { cancelOwnedShellTrees } from '../../tools/lib/owned-shell-trees.mjs';
@@ -142,6 +143,7 @@ function finishClose({ id, reason, tombstone, entry, closeSnapshot, newGen, outc
   // above; committing it stops the turn's checkpoint writer. Only now is it
   // safe to remove the crash fallback.
   closeSnapshot?.commit();
+  publishSessionPersistence(id, 'closed');
   _stopToolActivityHeartbeat(id);
   cancelOwnedShellProcesses({ id, reason, tombstone });
   clearTurnCheckpoint(id);

package/src/runtime/agent/orchestrator/session/manager/session-lifecycle.mjs

@@ -288,6 +288,13 @@ export function createSession(createOpts) {
     if (rulesRevision) session.rulesRevision = rulesRevision;
   }
   if (routeFallbacks?.length) session.routeFallbacks = routeFallbacks;
+  // Where an agent's chain is read from at each hop (route-fallback-chain.mjs).
+  const fallbackSource = Object.hasOwn(opts, 'routeFallbackSource')
+    ? opts.routeFallbackSource
+    : presetObj?.fallbackSource;
+  if (!actingAgent && fallbackSource && typeof fallbackSource === 'object') {
+    session.routeFallbackSource = { ...fallbackSource };
+  }
   // A non-native agent sends core + bridge, built from its filtered tools.
   applyAgentToolExposure(session);
   refreshSessionBp3Environment(session, opts.cwd);
@@ -364,6 +371,7 @@ function applyRouteFields(session, route) {
     else delete session.routeFallbacks;
     delete session.routeFallbackIndex;
     delete session.routeFallbackFailures;
+    delete session.routeFallbackPrimary;
   }
   ensureCodexWireSessionId(session);
   if (Object.hasOwn(route, 'modelParameters')) {

package/src/runtime/agent/orchestrator/session/manager/session-record.mjs

@@ -36,7 +36,7 @@ export function normalizeDesktopSessionMetadata(value, cwd = null) {
   return null;
 }
 
-function initialCompactionConfig(compaction = {}, contextMeta = {}) {
+export function initialCompactionConfig(compaction = {}, contextMeta = {}) {
   return {
     auto: compaction?.auto !== false,
     model: compaction?.model || null,

package/src/runtime/agent/orchestrator/session/manager/session-tool-surface.mjs

@@ -10,6 +10,9 @@ import { isAgentOwner } from '../../agent-owner.mjs';
 import { getHiddenAgent } from '../../internal-agents.mjs';
 import { workflowDisallowsAgentTool } from '../../runtime-core/workflow.mjs';
 import { isAgentModeSession } from '../agent-mode.mjs';
+import { agentIdOfHomeSession } from '../agent-home.mjs';
+import { roomMemberOfSession } from '../agent-room.mjs';
+import { REACTION_TOOL_NAME } from '../../runtime-core/reaction-tool-defs.mjs';
 import { finalizeSessionToolList, resolveSessionTools, permissionFromToolSpec } from './tool-resolution.mjs';
 import { unusedModelEditToolName } from '../../../../shared/edit-tool-dialect.mjs';
 import { getAgentRuntimeSync } from './agent-runtime-singleton.mjs';
@@ -24,6 +27,14 @@ export function delegationDisabled(source, ownerIsAgent) {
   );
 }
 
+// The react tool belongs to a bot's own chat with the user: its home chat
+// (`sess_home_<id>`) or its seat in a group room (`sess_rmem_…`), decided by the
+// session's id, never a coding session or a delegated worker.
+export function reactionDisabled(source, ownerIsAgent) {
+  const id = String(source?.id || '');
+  return ownerIsAgent || !(agentIdOfHomeSession(id) || roomMemberOfSession(id));
+}
+
 // Exactly two schema surfaces exist: Lead and Agent. Every Agent role gets
 // the full Lead-capable base bundle; the recursive `agent` control tool is
 // removed later at the owner boundary. Role permission remains prompt/
@@ -79,6 +90,7 @@ export function resolveSessionToolSurface(opts, { profile, toolPreset, modelName
   const sessionDeny = [
     ...(Array.isArray(opts.disallowedTools) ? opts.disallowedTools : []),
     ...(delegationDisabled(opts, ownerIsAgent) ? ['agent'] : []),
+    ...(reactionDisabled(opts, ownerIsAgent) ? [REACTION_TOOL_NAME] : []),
   ];
   // Role permission is prompt/diagnostic metadata only. Resolve and persist
   // it without shaping the provider-visible Agent schema.
@@ -144,6 +156,7 @@ export function _prepareResumeTools(session, preset) {
       disallowedTools: [
         ...(Array.isArray(session.disallowedTools) ? session.disallowedTools : []),
         ...(delegationDisabled(session, ownerIsAgent) ? ['agent'] : []),
+        ...(reactionDisabled(session, ownerIsAgent) ? [REACTION_TOOL_NAME] : []),
       ],
       ownerIsAgent,
     }),

package/src/runtime/agent/orchestrator/session/manager/tool-resolution.mjs

@@ -3,7 +3,8 @@
 import { compareCodePoints } from '../../../../shared/code-point-order.mjs';
 import { getMcpTools } from '../../mcp/client.mjs';
 import { getInternalTools } from '../../internal-tools.mjs';
-import { BUILTIN_TOOLS } from '../../tools/builtin/builtin-tools.mjs';
+import { BUILTIN_TOOLS, bindShellKind } from '../../tools/builtin/builtin-tools.mjs';
+import { resolveShellFor } from '../../tools/builtin/shell-runtime.mjs';
 import { PATCH_TOOL_DEFS } from '../../tools/patch-tool-defs.mjs';
 import { CODE_GRAPH_TOOL_DEFS } from '../../tools/code-graph-tool-defs.mjs';
 import { buildSkillToolDefs } from '../../context/collect.mjs';
@@ -101,7 +102,11 @@ export function resolveSessionTools(
   // time (loop.mjs), so the schema bytes stay bit-identical across roles /
   // cwds and the provider cache shard does not fragment.
   const skillTools = buildSkillToolDefs(skills, { ownerIsAgentSession });
-  return filterModelEditTools(_computeBaseTools(toolSpec, mcp, skillTools), modelName);
+  // The shell text follows the system shell the runtime actually resolves
+  // (Git Bash/WSL on Windows, pwsh on POSIX), before the edit-dialect rewrite.
+  const shellKind = resolveShellFor('default')?.shellType;
+  const base = _computeBaseTools(toolSpec, mcp, skillTools).map((tool) => bindShellKind(tool, shellKind));
+  return filterModelEditTools(base, modelName);
 }
 
 export function previewSessionTools(toolSpec, skills = [], options = {}) {

package/src/runtime/agent/orchestrator/session/manager/turn-checkpoint-journal.mjs

@@ -39,6 +39,8 @@ import { join } from 'node:path';
 import { getPluginData } from '../../config.mjs';
 import { writeFileAtomicSync } from '../../../../shared/atomic-file.mjs';
 import { sanitizeContentForStoredHistory } from '../../providers/media-normalization.mjs';
+import { redactSettledText, sensitiveValuesVersion } from '../sensitive-values.mjs';
+import { redactSensitiveContent, redactSensitiveMessage, redactSensitiveToolCall } from '../sensitive-projection.mjs';
 import { promptContentText } from './prompt-utils.mjs';
 
 const TURN_CHECKPOINT_VERSION = 1;
@@ -96,7 +98,7 @@ export function checkpointMessage(message) {
   return content === message.content ? message : { ...message, content };
 }
 
-export function matchingUserMessage(message, currentUserContent) {
+function matchingUserMessage(message, currentUserContent) {
   return (
     message?.role === 'user' &&
     (message.content === currentUserContent ||
@@ -131,16 +133,54 @@ export function emptyInterruptionSnapshot() {
   };
 }
 
-// ── Header (write-once, atomic) ─────────────────────────────────────────────
+// Observed tool calls ([id, { call, eagerStarted }]) and early tool results
+// ([id, tool message]) as a checkpoint stores them (sensitive-projection.mjs).
+const storedCallEntries = (sessionId, entries) =>
+  entries.map(([id, entry]) => {
+    const call = redactSensitiveToolCall(sessionId, entry?.call);
+    return [id, call === entry?.call ? entry : { ...entry, call }];
+  });
+const storedResultEntries = (sessionId, entries) =>
+  entries.map(([id, message]) => [id, redactSensitiveMessage(sessionId, message)]);
+
+/** Interruption snapshot `snapshot` as `sessionId`'s checkpoint stores it:
+ *  sensitive values (sensitive-values.mjs) replaced, and of the partial text
+ *  only what no value can still complete. */
+function redactInterruptionSnapshot(sessionId, snapshot) {
+  const source = snapshot ?? emptyInterruptionSnapshot();
+  if (!sensitiveValuesVersion(sessionId)) return source;
+  return {
+    ...source,
+    partialAssistantContent: redactSettledText(sessionId, String(source.partialAssistantContent || '')),
+    partialReasoningContent: redactSettledText(sessionId, String(source.partialReasoningContent || '')),
+    observedToolCalls: storedCallEntries(
+      sessionId,
+      Array.isArray(source.observedToolCalls) ? source.observedToolCalls : []
+    ),
+    observedToolResults: storedResultEntries(
+      sessionId,
+      Array.isArray(source.observedToolResults) ? source.observedToolResults : []
+    ),
+  };
+}
+
+// ── Header (written once per turn, again when a sensitive value is marked) ──
 
 export function writeCheckpointHeader(checkpoint) {
-  const target = turnCheckpointPath(checkpoint.sessionId);
+  const { sessionId } = checkpoint;
+  const target = turnCheckpointPath(sessionId);
   const payload = {
     ...checkpoint,
     version: TURN_CHECKPOINT_VERSION,
-    currentUserContent: sanitizeContentForStoredHistory(checkpoint.currentUserContent),
-    turnMessages: (Array.isArray(checkpoint.turnMessages) ? checkpoint.turnMessages : []).map(checkpointMessage),
-    interruption: checkpoint.interruption ?? emptyInterruptionSnapshot(),
+    currentUserContent: redactSensitiveContent(
+      sessionId,
+      sanitizeContentForStoredHistory(checkpoint.currentUserContent)
+    ),
+    turnMessages: (Array.isArray(checkpoint.turnMessages) ? checkpoint.turnMessages : []).map((message) =>
+      redactSensitiveMessage(sessionId, checkpointMessage(message))
+    ),
+    interruption: redactInterruptionSnapshot(sessionId, checkpoint.interruption),
+    // Counts, token readings and signatures only: no text.
     contextState: checkpoint.contextState ?? null,
     updatedAt: Date.now(),
   };
@@ -488,7 +528,15 @@ export function replayTurnJournal(header) {
     if (seq > expected) break;
     expected = seq + 1;
     if (!head) {
-      if (record.t !== 'h' || record.turnToken !== header.turnToken) return header;
+      // A header rewritten for a newly marked sensitive value starts a new
+      // journal epoch; the journal it replaces never replays onto it.
+      if (
+        record.t !== 'h' ||
+        record.turnToken !== header.turnToken ||
+        (Number(record.e) || 0) !== (Number(header.journalEpoch) || 0)
+      ) {
+        return header;
+      }
       head = true;
       continue;
     }
@@ -529,7 +577,7 @@ export function replayTurnJournal(header) {
  * turn-relative index) plus an opaque interruption cursor, so each encode()
  * touches only what changed since the previous flush.
  */
-export function createTurnJournalEncoder({ turnToken } = {}) {
+export function createTurnJournalEncoder({ turnToken, sessionId = null } = {}) {
   let journaled = [];
   let fullTranscript = false;
   let cursor = null;
@@ -537,27 +585,65 @@ export function createTurnJournalEncoder({ turnToken } = {}) {
   // Per-turn record sequence. It is assigned where records are produced, so
   // the number line is exactly the enqueue order the write lane preserves.
   let seq = 0;
+  // Set while the session has sensitive values (sensitive-values.mjs): the
+  // tracker's state as its deltas build it (`raw`) and the state the journal
+  // replays to (`written`). Interruption deltas are then journaled as the
+  // difference of the redacted text, so a value that streams in across
+  // flushes never lands in pieces. A newly marked value reseeds the encoder
+  // (turn-checkpoint.mjs), so the session's values are known whenever this is null.
+  let mirror = null;
   const line = (record) => {
     const stamped = { ...record, s: seq };
     seq += 1;
     return `${JSON.stringify(stamped)}\n`;
   };
+  const stored = (message) => redactSensitiveMessage(sessionId, checkpointMessage(message));
+  const interruptionRecord = (delta) => {
+    if (!mirror) return delta;
+    applyInterruptionDelta(mirror.raw, delta);
+    const out = {};
+    for (const key of ['rs', 'ph', 'cc', 'od']) if (Object.hasOwn(delta, key)) out[key] = delta[key];
+    for (const [field, setKey, appendKey] of [
+      ['text', 'ts', 'ta'],
+      ['reasoning', 'qs', 'qa'],
+    ]) {
+      const settled = redactSettledText(sessionId, mirror.raw[field]);
+      const written = mirror.written[field];
+      if (settled === written) continue;
+      if (settled.startsWith(written)) out[appendKey] = settled.slice(written.length);
+      else out[setKey] = settled;
+    }
+    if (Object.hasOwn(delta, 'tb')) out.tb = redactSensitiveContent(sessionId, mirror.raw.tomb);
+    if (delta.cs) out.cs = storedCallEntries(sessionId, delta.cs);
+    if (delta.os) out.os = storedResultEntries(sessionId, delta.os);
+    applyInterruptionDelta(mirror.written, out);
+    return out;
+  };
   return {
     /** Seed from the turn's opening state; returns the header's messages
      * and the journal's opening lines (head record, plus — defensively —
      * the delta that makes the journal authoritative if the tracker already
-     * carried state at open time). */
-    seed(turnOutgoing, currentUserContent, interruption, contextState = null) {
+     * carried state at open time). `snapshot` is the tracker snapshot the
+     * header stores; `epoch` names the journal a rewritten header starts. */
+    seed(turnOutgoing, currentUserContent, interruption, contextState = null, { snapshot = null, epoch = 0 } = {}) {
       const source = Array.isArray(turnOutgoing) ? turnOutgoing : [];
       const start = findTurnStart(source, currentUserContent);
       fullTranscript = start < 0;
       journaled = fullTranscript ? source.slice() : source.slice(start);
+      mirror = sensitiveValuesVersion(sessionId)
+        ? {
+            raw: interruptionStateFromSnapshot(snapshot),
+            written: interruptionStateFromSnapshot(redactInterruptionSnapshot(sessionId, snapshot)),
+          }
+        : null;
       const seeded = typeof interruption?.journalDelta === 'function' ? interruption.journalDelta(null) : null;
       cursor = seeded ? seeded.cursor : null;
       contextStateKey = contextState == null ? null : JSON.stringify(contextState);
       seq = 0;
-      const openLines = [line({ t: 'h', turnToken, at: Date.now() })];
-      if (seeded?.changed) openLines.push(line({ t: 'x', d: seeded.delta, at: Date.now() }));
+      const openLines = [line({ t: 'h', turnToken, ...(epoch ? { e: epoch } : {}), at: Date.now() })];
+      const seededDelta = seeded?.changed ? interruptionRecord(seeded.delta) : null;
+      if (seededDelta && Object.keys(seededDelta).length)
+        openLines.push(line({ t: 'x', d: seededDelta, at: Date.now() }));
       return {
         turnMessages: journaled.map(checkpointMessage),
         fullTranscript,
@@ -579,7 +665,7 @@ export function createTurnJournalEncoder({ turnToken } = {}) {
         journaled = source.slice();
         records.push({
           t: 'full',
-          ms: journaled.map(checkpointMessage),
+          ms: journaled.map(stored),
         });
       } else {
         const offset = fullTranscript ? 0 : start;
@@ -588,7 +674,7 @@ export function createTurnJournalEncoder({ turnToken } = {}) {
           const raw = source[offset + index];
           if (journaled[index] === raw) continue;
           journaled[index] = raw;
-          records.push({ t: 'm', i: index, m: checkpointMessage(raw) });
+          records.push({ t: 'm', i: index, m: stored(raw) });
         }
         if (journaled.length > length) {
           journaled.length = length;
@@ -598,7 +684,8 @@ export function createTurnJournalEncoder({ turnToken } = {}) {
       if (typeof interruption?.journalDelta === 'function') {
         const next = interruption.journalDelta(cursor);
         cursor = next.cursor;
-        if (next.changed) records.push({ t: 'x', d: next.delta });
+        const delta = next.changed ? interruptionRecord(next.delta) : null;
+        if (delta && Object.keys(delta).length) records.push({ t: 'x', d: delta });
       }
       const nextContextStateKey = contextState == null ? null : JSON.stringify(contextState);
       if (nextContextStateKey !== contextStateKey) {

package/src/runtime/agent/orchestrator/session/manager/turn-checkpoint.mjs

@@ -19,6 +19,7 @@ import {
 } from './turn-checkpoint-journal.mjs';
 import { captureTurnCheckpointContextState, restoreTurnCheckpointContextState } from './turn-checkpoint-context.mjs';
 import { stripProviderReplayMessages } from './provider-replay.mjs';
+import { sensitiveValuesVersion } from '../sensitive-values.mjs';
 
 export { turnCheckpointPath, turnMessagesForCheckpoint };
 export { captureTurnCheckpointContextState, restoreTurnCheckpointContextState };
@@ -67,9 +68,14 @@ export function projectTurnCheckpointMessages(session, checkpoint) {
 // long tool-heavy turn no longer amplifies into the shared engine thread that
 // every fanned-out agent session shares.
 export function createTurnCheckpointRecorder({ sessionId, generation, turnToken, startedAt }) {
-  const encoder = createTurnJournalEncoder({ turnToken });
+  const encoder = createTurnJournalEncoder({ turnToken, sessionId });
   let opened = false;
   let stopped = false;
+  // The sensitive-values version (sensitive-values.mjs) the header and
+  // journal were written under. A newly marked value rewrites both from the
+  // turn's current state with the value replaced, under a new journal epoch,
+  // so no recovery record keeps it.
+  let openedVersion = 0;
   return {
     get opened() {
       return opened;
@@ -77,8 +83,14 @@ export function createTurnCheckpointRecorder({ sessionId, generation, turnToken,
     /** True when this call wrote or queued durable state. */
     record({ currentUserContent, turnOutgoing, interruption, contextState = null }) {
       if (stopped || !sessionId || !turnToken) return false;
-      if (!opened) {
-        const seed = encoder.seed(turnOutgoing, currentUserContent, interruption, contextState);
+      const version = sensitiveValuesVersion(sessionId);
+      if (!opened || version !== openedVersion) {
+        const snapshot =
+          typeof interruption?.snapshot === 'function' ? interruption.snapshot() : emptyInterruptionSnapshot();
+        const seed = encoder.seed(turnOutgoing, currentUserContent, interruption, contextState, {
+          snapshot,
+          epoch: version,
+        });
         writeCheckpointHeader({
           sessionId,
           generation,
@@ -87,10 +99,11 @@ export function createTurnCheckpointRecorder({ sessionId, generation, turnToken,
           currentUserContent,
           turnMessages: seed.turnMessages,
           ...(seed.fullTranscript ? { fullTranscript: true } : {}),
-          interruption:
-            typeof interruption?.snapshot === 'function' ? interruption.snapshot() : emptyInterruptionSnapshot(),
+          ...(version ? { journalEpoch: version } : {}),
+          interruption: snapshot,
           contextState: seed.contextState,
         });
+        openedVersion = version;
         // Opening the journal is part of the anchor: a leftover journal
         // from an earlier turn of this session must never replay onto
         // the new header. It lands synchronously when the lane is idle

package/src/runtime/agent/orchestrator/session/message-ids.mjs

@@ -26,7 +26,7 @@ export function messageIdOf(message) {
 }
 
 /** Whether `meta` can hold a transcript id (absent or a plain object). */
-export function canCarryMessageId(message) {
+function canCarryMessageId(message) {
   if (!message || typeof message !== 'object') return false;
   const meta = message.meta;
   return meta === undefined || meta === null || (typeof meta === 'object' && !Array.isArray(meta));
@@ -101,12 +101,14 @@ export function stampMessageIds(messages, { sessionId = '' } = {}) {
 
 /** JSON.stringify replacer that leaves stable ids out: hashes and archives
  *  the compactor derives from message JSON describe the conversation, not
- *  its display bookkeeping (a meta that only held the id is left out too). */
+ *  its display bookkeeping (a meta that only held the id is left out too).
+ *  Reactions on a message (message-reactions.mjs) are display bookkeeping of
+ *  the same kind, written in place mid-turn, and are left out with the id. */
 export function withoutMessageIdsReplacer(key, value) {
   if (key !== 'meta' || !value || typeof value !== 'object' || typeof value.transcript?.messageId !== 'string') {
     return value;
   }
-  const { messageId: _id, ...transcript } = value.transcript;
+  const { messageId: _id, reactions: _reactions, ...transcript } = value.transcript;
   const meta = { ...value };
   if (Object.keys(transcript).length) meta.transcript = transcript;
   else delete meta.transcript;