mixdog 1.3.5 → 1.4.0

package/src/session-runtime/services/agent-tool/worker-index.mjs

@@ -6,71 +6,33 @@
 //   row-store      — the file, its parse cache, the locked writer
 //   mutation-batch — spawn-path writes coalesced onto one immediate
 //   row-liveness   — stale-active detection and idle settlement
+//   row-reads          — scoped row and tag-tombstone reads
+//   row-writes         — upserts, removal, the owner's release mark
+//   awaiting-user-sync — approval waits kept in step with the runtime
+//   restart-settlement — rows a process exit or restart ended
+//   disposal           — drain, then release the registrations
 import { resolve } from 'node:path';
 
 import { WORKER_INDEX_FILE } from './tool-def.mjs';
-import { clean, positiveInt, registerExitFlush, rowMatchesContext } from './helpers.mjs';
-import { applyWorkerRowUpsert, recoverTagTombstoneOwner, workerRowKey } from './worker-rows.mjs';
-import {
-  applyAwaitingUser,
-  awaitingUserWouldChange,
-  clearAwaitingUser,
-  registerApprovalWaitWriter,
-} from './worker-index/approval-wait.mjs';
+import { registerExitFlush, rowMatchesContext } from './helpers.mjs';
+import { registerApprovalWaitWriter } from './worker-index/approval-wait.mjs';
+import { createAwaitingUserSync } from './worker-index/awaiting-user-sync.mjs';
+import { createIndexDisposal } from './worker-index/disposal.mjs';
 import { createMutationBatch } from './worker-index/mutation-batch.mjs';
-import {
-  createRowLiveness,
-  isActiveWorkerRow,
-  isStaleApprovalWait,
-  isUnnotifiedRestartFailure,
-  PROCESS_RESTART_FAILURE,
-  runtimeDied,
-} from './worker-index/row-liveness.mjs';
-import { normalizeWorkerRows, workerRowFromSession } from './worker-index/row-shape.mjs';
+import { createRestartSettlement } from './worker-index/restart-settlement.mjs';
+import { createWorkerRowReads } from './worker-index/row-reads.mjs';
 import { acquireWorkerRowStore } from './worker-index/row-store.mjs';
-import { findTagTombstone, tagTombstoneKey, tombstoneBlocksWork } from '../../../runtime/shared/agent-reap-state.mjs';
+import { createWorkerRowWrites } from './worker-index/row-writes.mjs';
+import { onSessionTurnStart } from '../../../runtime/shared/session-activity-signal.mjs';
 
 export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCwds }) {
   const file = dataDir ? resolve(dataDir, WORKER_INDEX_FILE) : null;
   // Shared with every other worker index of this process over the same file.
   const { store, release: releaseStore } = acquireWorkerRowStore(file);
-  // Sessions whose deferred rows still wait in the batch; reconciled once the
-  // batch lands in the store.
-  const unreconciled = new Set();
-  const batch = createMutationBatch(store.write, () => {
-    const ids = [...unreconciled];
-    unreconciled.clear();
-    for (const id of ids) reconcileAwaitingUser(id);
-  });
-  const liveness = createRowLiveness({
-    cfgMod,
-    isSessionRunning: (sessionId) => mgr.isSessionTurnInFlight?.(sessionId) === true,
-  });
-  // Rows this process marked active; settled as failed on exit (their turn
-  // dies with the process) so a crash of the host never leaves them
-  // "running" forever.
-  const activeWorkerKeys = new Set();
-
-  function readWorkerRows(context = {}) {
-    const { rows, tombstones: savedTombstones } = store.readSnapshot();
-    if (rows.length === 0) return rows;
-    const tombstones = new Map(recoverTombstoneOwners(savedTombstones).map((row) => [tagTombstoneKey(row), row]));
-    return rows.filter(
-      (row) => rowMatchesContext(row, context) && !tombstoneBlocksWork(row, findTagTombstone(row, tombstones))
-    );
-  }
-
-  function readAllTagTombstones() {
-    return recoverTombstoneOwners(store.readTombstones());
-  }
-
-  function recoverTombstoneOwners(rows) {
-    if (!rows.some((row) => !clean(row.parentSessionId || row.ownerSessionId))) return rows;
-    const sessions = typeof mgr.listSessions === 'function' ? mgr.listSessions({ includeClosed: true }) : [];
-    // Resolve legacy ownership against all sessions, never just the caller's
-    // scope: filtering first would conceal an ambiguous sibling owner.
-    return rows.map((row) => recoverTagTombstoneOwner(row, sessions));
-  }
+  const awaitingUser = createAwaitingUserSync(store, mgr);
+  const batch = createMutationBatch(store.write, awaitingUser.reconcileDeferred);
+  const settlement = createRestartSettlement({ store, cfgMod, mgr });
+  const { readWorkerRows, readAllTagTombstones } = createWorkerRowReads(store, mgr);
 
   // Every upsert also projects the row into the in-memory tag maps so tag
   // lookups never wait on a disk round-trip.
@@ -80,68 +42,20 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
     if (row.cwd) tagCwds.set(row.tag, row.cwd);
   }
 
-  function upsertWorkerRow(row, { defer = false } = {}) {
-    const normalized = normalizeWorkerRows({ workers: [row] })[0];
-    if (!normalized) return false;
-    const key = workerRowKey(normalized);
-    if (isActiveWorkerRow(normalized)) activeWorkerKeys.add(key);
-    else activeWorkerKeys.delete(key);
-    bindTag(normalized);
-    if (defer) {
-      if (!file) return false;
-      unreconciled.add(normalized.sessionId);
-      return batch.queue((byKey) => applyWorkerRowUpsert(byKey, normalized));
-    }
-    store.write((byKey) => {
-      applyWorkerRowUpsert(byKey, normalized);
-    });
-    reconcileAwaitingUser(normalized.sessionId);
-    return true;
-  }
-
-  const rowFromSession = (session, fallbackTag = '', extra = {}) =>
-    workerRowFromSession(session, fallbackTag, extra, (sessionId) => mgr.getSessionRuntime?.(sessionId));
-
-  // A row whose owner is still owed its restart failure stays: closing the
-  // worker (a process exit closes every one) must not lose that result.
-  function removeWorkerRow({ tag = '', sessionId = '' } = {}) {
-    const targetTag = clean(tag);
-    const targetSessionId = clean(sessionId);
-    batch.flush();
-    store.write((byKey) => {
-      for (const [key, row] of [...byKey.entries()]) {
-        if (isUnnotifiedRestartFailure(row)) continue;
-        if ((targetSessionId && row.sessionId === targetSessionId) || (targetTag && row.tag === targetTag)) {
-          byKey.delete(key);
-        }
-      }
-    });
-  }
-
-  /** Persist (or clear) a worker's approval wait as a field update fenced to
-   *  the session and its turn (`turnAt`, ms): a row whose turn started later is
-   *  left alone. Writes only when a row of that session exists and would
-   *  change, so a Lead's own approvals cost nothing; a row that is not in the
-   *  store yet takes the wait when it lands (reconcileAwaitingUser). */
-  function setAwaitingUser(sessionId, awaitingUser, { turnAt = 0 } = {}) {
-    const fence = {
-      sessionId: clean(sessionId),
-      awaitingUser: awaitingUser === 'approval' ? 'approval' : null,
-      turnAt: Number(turnAt) || 0,
-    };
-    if (!fence.sessionId || !awaitingUserWouldChange(store.readAll(), fence)) return false;
-    store.update((byKey) => applyAwaitingUser(byKey, fence));
-    return true;
-  }
+  const { upsertWorkerRow, rowFromSession, markReleased, removeWorkerRow } = createWorkerRowWrites({
+    file,
+    store,
+    batch,
+    mgr,
+    bindTag,
+    settlement,
+    awaitingUser,
+  });
 
-  /** The runtime of a session this process runs is the authority on its
-   *  approval wait (the runtime-liveness counter behind `awaitingUser`): every
-   *  row it creates or refreshes takes that state, so a missed or stale
-   *  transition heals on the next write. No runtime here: not ours to judge. */
-  function reconcileAwaitingUser(sessionId) {
-    const runtime = mgr.getSessionRuntime?.(sessionId);
-    if (runtime) setAwaitingUser(sessionId, runtime.awaitingUser, { turnAt: runtime.askStartedAt });
-  }
+  // The one boundary every turn start passes through (user input, an answer,
+  // auto-resume, a send, a room/bot turn): the session is in use again, for
+  // good, whatever started the turn.
+  const stopTurnStartListener = onSessionTurnStart((sessionId) => store.clearReleased(sessionId));
 
   function refreshTagsFromIndex(context = {}) {
     const rows = readWorkerRows(context);
@@ -149,142 +63,27 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
     return rows;
   }
 
-  function flushActiveWorkerRows() {
-    if (!activeWorkerKeys.size) return;
-    const keys = [...activeWorkerKeys];
-    activeWorkerKeys.clear();
-    const now = Date.now();
-    store.write((byKey) => {
-      for (const key of keys) {
-        const current = byKey.get(key);
-        if (!current || positiveInt(current.runtimePid) !== process.pid) continue;
-        if (isActiveWorkerRow(current)) {
-          byKey.set(key, liveness.failedRow(current, now, PROCESS_RESTART_FAILURE, true));
-        }
-      }
-    });
-  }
-
-  // Startup recovery: stale active rows settle — as failed when another
-  // process ran their turn (it is gone, or is the predecessor still shutting
-  // down: either way the turn never finished), otherwise to idle — and an
-  // approval wait left behind by a runtime that is gone (daemon restart) is
-  // cleared. `deadOnly` (later sweeps) settles only rows whose runtime is
-  // provably dead, never a live process's quiet turn.
-  function recoverStaleWorkerRows({ deadOnly = false } = {}) {
-    const now = Date.now();
-    const rows = store.readAll();
-    const isStale = deadOnly
-      ? (row) => isActiveWorkerRow(row) && runtimeDied(row)
-      : (row) => liveness.isStaleActive(row, now);
-    const staleActive = rows.filter(isStale);
-    const staleWaits = rows.some(isStaleApprovalWait);
-    if (!staleActive.length && !staleWaits) return false;
-    if (staleActive.length) {
-      store.write((byKey) => {
-        for (const row of staleActive) {
-          const key = workerRowKey(row);
-          const current = byKey.get(key);
-          if (!current || !isStale(current)) continue;
-          const ranElsewhere = positiveInt(current.runtimePid) && positiveInt(current.runtimePid) !== process.pid;
-          byKey.set(
-            key,
-            ranElsewhere ? liveness.failedRow(current, now, PROCESS_RESTART_FAILURE) : liveness.idleRow(current, now)
-          );
-        }
-      });
-    }
-    if (staleWaits) store.update((byKey) => clearAwaitingUser(byKey, isStaleApprovalWait));
-    return true;
-  }
-
-  /** Rows whose turn a process restart ended and whose owner has not been told
-   *  yet — whoever settled the row (this process at startup, or the
-   *  predecessor's exit flush). Read-only: the caller enqueues the owner's
-   *  notification durably, THEN calls `markRestartNotified`, so a crash in
-   *  between retries (the notification's stable id makes the retry exactly-once). */
-  function pendingRestartFailures() {
-    return store.readAll().filter(isUnnotifiedRestartFailure);
-  }
-
-  /** Stamp these rows as told, once their notification is durably queued. */
-  function markRestartNotified(rows) {
-    const stamp = new Date().toISOString();
-    store.write((byKey) => {
-      for (const row of rows) {
-        const key = workerRowKey(row);
-        const current = byKey.get(key);
-        if (!current || !isUnnotifiedRestartFailure(current)) continue;
-        byKey.set(key, { ...current, restartNotified: stamp });
-      }
-    });
-  }
-
   function flushWorkerIndexOnExit() {
     batch.flush();
-    flushActiveWorkerRows();
+    settlement.flushActiveWorkerRows();
     // Writes are persisted by an async queue; the loop is gone at exit. This
     // is the best-effort last resort: a persist still running is left alone
     // (the graceful shutdown path drains before exit).
     store.flushSync();
   }
 
-  recoverStaleWorkerRows();
+  settlement.recoverStaleWorkerRows();
   const unregisterExitFlush = registerExitFlush(flushWorkerIndexOnExit);
-  const unregisterApprovalWaits = registerApprovalWaitWriter(file, setAwaitingUser);
-  let disposed = false;
-  let disposePromise = null;
+  const unregisterApprovalWaits = registerApprovalWaitWriter(file, awaitingUser.setAwaitingUser);
 
   function teardown() {
+    stopTurnStartListener();
     unregisterExitFlush();
     unregisterApprovalWaits();
     releaseStore();
   }
 
-  async function drainThenTeardown() {
-    batch.flush();
-    await store.flush();
-    teardown();
-  }
-
-  /** Persist queued rows, then release the exit registration. Active rows are
-   *  NOT settled: they are keyed by process pid, which every inline runtime in
-   *  the daemon shares, so settling here would idle other runtimes' workers.
-   *  When the sync flush cannot run (this process's async writer holds the
-   *  lock) the exit hook and store ref stay until the async drain settles. */
-  function dispose() {
-    if (disposed) return;
-    disposed = true;
-    let flushed = false;
-    try {
-      batch.flush();
-      flushed = store.flushSync();
-    } catch {}
-    if (flushed) {
-      teardown();
-      return;
-    }
-    disposePromise = drainThenTeardown().catch(reopenAfterFailedDrain);
-  }
-
-  /** A failed drain tears nothing down; allow a later dispose to retry it. */
-  function reopenAfterFailedDrain() {
-    disposed = false;
-    disposePromise = null;
-  }
-
-  /** Awaitable dispose: drain everything, then tear down. A failed drain
-   *  rejects and leaves the registrations in place. */
-  function disposeAsync() {
-    if (!disposePromise) {
-      disposed = true;
-      disposePromise = drainThenTeardown().catch((error) => {
-        reopenAfterFailedDrain();
-        throw error;
-      });
-    }
-    return disposePromise;
-  }
+  const { dispose, disposeAsync } = createIndexDisposal({ batch, store, teardown });
 
   return {
     dispose,
@@ -310,12 +109,13 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
     upsertWorkerSessionDeferred: (session, fallbackTag = '', extra = {}) =>
       upsertWorkerRow(rowFromSession(session, fallbackTag, extra), { defer: true }),
     removeWorkerRow,
-    setAwaitingUser,
+    markReleased,
+    setAwaitingUser: awaitingUser.setAwaitingUser,
     refreshTagsFromIndex,
-    flushActiveWorkerRows,
+    flushActiveWorkerRows: settlement.flushActiveWorkerRows,
     flushWorkerIndexOnExit,
-    recoverStaleWorkerRows,
-    pendingRestartFailures,
-    markRestartNotified,
+    recoverStaleWorkerRows: settlement.recoverStaleWorkerRows,
+    pendingRestartFailures: settlement.pendingRestartFailures,
+    markRestartNotified: settlement.markRestartNotified,
   };
 }

package/src/session-runtime/services/agent-tool/worker-rows.mjs

@@ -129,6 +129,9 @@ export function applyWorkerRowUpsert(byKey, normalized) {
       merged[field] = prev[field];
     }
   }
+  // A whole-row write carries the session's release state: a row written
+  // without it (the agent was reused) is no longer released.
+  if (normalized.released !== true) delete merged.released;
   // `awaitingUser` is not decided here: the worker row store keeps the current
   // row's flag across every whole-row write and drops it once the row settles.
   byKey.set(key, {

package/src/session-runtime/services/channel-admin.mjs

@@ -62,7 +62,6 @@ function normalizeChannelsConfig(raw = {}) {
   return {
     ...CHANNELS_DEFAULTS,
     ...stored,
-    access: { ...CHANNELS_DEFAULTS.access, ...(stored.access || {}) },
     webhook: { ...CHANNELS_DEFAULTS.webhook, ...(stored.webhook || {}) },
   };
 }
@@ -189,7 +188,7 @@ function parseAtDatetime(at) {
 
 // Map the store's def shape onto the flat display shape every schedule reader
 // (channelSetup, renderChannelStatus, TUI pickers) consumes: `.time` renders
-// the cron or the one-shot datetime, `.route` the channel/session target.
+// the cron or the one-shot datetime.
 function scheduleToDisplay(s, ownerProblem = '') {
   return {
     name: s.name,
@@ -202,7 +201,6 @@ function scheduleToDisplay(s, ownerProblem = '') {
     attachments: s.attachments || undefined,
     enabled: s.enabled !== false,
     instructions: s.prompt,
-    route: 'session',
     // The bot it belongs to: each run is a turn in that bot's chat.
     owner: s.ownerAgentId || MIXY_AGENT_ID,
     // Why it is paused for its owner (routine-owner.mjs); absent when it runs.
@@ -252,7 +250,8 @@ function scheduleOwner(owner, existing) {
   return existing?.ownerAgentId || MIXY_AGENT_ID;
 }
 
-/** Each owner's problem (routine-owner.mjs), probed once per owner. */
+/** Each owner's problem (routine-owner.mjs) for its stored rows, probed once
+ *  per owner. */
 function ownerProblems() {
   const seen = new Map();
   return (ownerAgentId) => {
@@ -260,7 +259,7 @@ function ownerProblems() {
     if (!seen.has(owner))
       seen.set(
         owner,
-        routineOwnerProblem(owner).catch(() => '')
+        routineOwnerProblem(owner, null, { stored: true }).catch(() => '')
       );
     return seen.get(owner);
   };
@@ -350,8 +349,6 @@ export async function saveSchedule(
     whenCron,
     whenAt,
     timezone: scheduleTimezone,
-    target: 'session',
-    channelId: null,
     cwd: cwd ? String(cwd).trim() : null,
     attachments: normalizeAutomationAttachments(attachments),
     delivery: 'app',
@@ -408,7 +405,6 @@ async function listWebhooks() {
     secretSet: ep.secretSet === true,
     secret: undefined,
     instructions: ep.instructions,
-    route: 'session',
     // The bot it belongs to: each run is a turn in that bot's chat.
     owner: ep.ownerAgentId || MIXY_AGENT_ID,
     ...(problems[index] ? { ownerProblem: problems[index] } : {}),
@@ -461,7 +457,6 @@ export async function saveWebhook({
     name: id,
     description: String(description || '').trim(),
     parser: nextParser,
-    channelId: null,
     cwd: cwd ? String(cwd).trim() : null,
     attachments: normalizeAutomationAttachments(attachments),
     delivery: 'app',
@@ -578,9 +573,8 @@ export async function testWebhook(name) {
 }
 
 // Automation presence: any enabled schedule or webhook endpoint. Drives the
-// worker boot decision independently of the messaging channels — schedules
-// and webhooks run sessions, so they must not require Discord/Telegram
-// tokens or an explicit remote toggle.
+// worker boot decision — schedules and webhooks run sessions, so they must
+// not require an explicit remote toggle.
 async function checkActiveAutomation() {
   const { schedules, webhooks } = await readAutomationRows();
   return hasEnabledAutomation({ schedules, webhooks });
@@ -603,7 +597,7 @@ async function readAutomationRows() {
 // at once; writes from other processes are picked up after ttlMs. A failed
 // check (e.g. PG still booting) answers false to its callers but is never
 // reused, so the next runtime checks again.
-export const AUTOMATION_PROBE_TTL_MS = 60_000;
+const AUTOMATION_PROBE_TTL_MS = 60_000;
 
 export function createAutomationProbe(check, { ttlMs = AUTOMATION_PROBE_TTL_MS, now = Date.now } = {}) {
   let pending = null;

package/src/session-runtime/services/channel-session-router.mjs

@@ -1,4 +1,5 @@
 import { channelNotificationModelContent } from '../../runtime/shared/channel-notification-routing.mjs';
+import { PROMPT_ORIGIN_CHANNEL } from '../../runtime/agent/orchestrator/session/manager/pending-message-entry.mjs';
 
 /** The one inbound channel notification method. Exported so every consumer
  *  (daemon router, session runtime) matches the same wire name. */
@@ -21,8 +22,9 @@ export function createChannelSessionRouter({ getSessionService, getSessionId, lo
         prompt: content,
         // A channel notification (webhook event rules carry fenced external
         // values) is queued as a task notification, never as typed input, so
-        // nothing inside it selects a skill.
-        options: { source: 'channel', mode: 'task-notification' },
+        // nothing inside it selects a skill. Its provenance (`origin`) says
+        // it is real external activity, which the mode alone does not.
+        options: { source: 'channel', mode: 'task-notification', origin: PROMPT_ORIGIN_CHANNEL },
       })
     ).catch((error) => {
       log(`channel session delivery failed session=${sessionId}: ${error?.message || error}`);

package/src/session-runtime/services/seeds.mjs

@@ -49,34 +49,6 @@ export function ensureStandaloneEnvironment({ rootDir, dataDir }) {
       /* marker only; the sweep simply repeats */
     }
   }
-  cleanupRetiredChannelSecrets(dataDir);
-}
-
-// One-shot keychain cleanup: Discord/Telegram messaging is retired, so any
-// stored bot tokens are orphans. Marker-gated so the (potentially slow) OS
-// keychain roundtrip runs once per install; lazy import so shared config
-// resolves its paths only after the env above is established.
-function cleanupRetiredChannelSecrets(dataDir) {
-  const marker = join(dataDir, '.retired-channel-secrets-cleaned');
-  if (existsSync(marker)) return;
-  void import('../../runtime/shared/config.mjs')
-    .then(async ({ deleteSecretAsync }) => {
-      for (const account of ['discord.token', 'telegram.token']) {
-        try {
-          await deleteSecretAsync(account);
-        } catch {
-          /* best-effort */
-        }
-      }
-      try {
-        writeFileAtomicSync(marker, `${new Date().toISOString()}\n`);
-      } catch {
-        /* marker only */
-      }
-    })
-    .catch(() => {
-      /* cleanup is best-effort */
-    });
 }
 
 // Shipped definitions live in code (read in place from the package); the data

package/src/session-runtime/session-compaction-sync.mjs

@@ -0,0 +1,27 @@
+// Keeps a live session's compaction settings on the saved global ones. One
+// helper for every path that can leave a session behind the config: saving the
+// settings, a shared-config reload, and adopting a resumed or swapped session.
+import { normalizeCompactionConfig } from '../runtime/agent/orchestrator/runtime-core/config-helpers.mjs';
+import { COMPACTION_CONFIG_KEYS } from '../runtime/agent/orchestrator/runtime-core/compaction-config-keys.mjs';
+
+/** A headless caller injects its own isolated config: its sessions keep the
+ *  compaction they were created with instead of following the profile on disk. */
+export function usesInjectedConfig(params) {
+  return Boolean(params?.initialConfig) && typeof params.initialConfig === 'object';
+}
+
+/** Replace the live session's compaction fields with the saved (normalized) ones. */
+export function adoptSessionCompaction(session, saved) {
+  if (!session) return;
+  const currentSessionCompaction = { ...(session.compaction || {}) };
+  // Anything outside the config-owned set (per-session thresholds, archive
+  // state, timing) is the session's own and survives.
+  for (const key of COMPACTION_CONFIG_KEYS) delete currentSessionCompaction[key];
+  session.compaction = { ...currentSessionCompaction, ...saved };
+}
+
+/** Follow `config.compaction` on a session; a config without the section leaves it alone. */
+export function syncSessionCompaction(session, config) {
+  if (!config?.compaction || typeof config.compaction !== 'object') return;
+  adoptSessionCompaction(session, normalizeCompactionConfig(config.compaction));
+}

package/src/session-runtime/session-create/session-options.mjs

@@ -33,6 +33,7 @@ function agentOwnedSessionFields(sessionProfile) {
     agentTag: sessionProfile?.agentTag || null,
     taskType: sessionProfile?.taskType || null,
     ...(sessionProfile?.routeFallbacks !== undefined ? { routeFallbacks: sessionProfile.routeFallbacks } : {}),
+    ...(sessionProfile?.routeFallbackSource ? { routeFallbackSource: sessionProfile.routeFallbackSource } : {}),
     permission: sessionProfile?.permission || undefined,
     permissionMode: sessionProfile?.permissionMode || undefined,
     schemaAllowedTools: Array.isArray(sessionProfile?.schemaAllowedTools)

package/src/session-runtime/settings-builtin-tools-api.mjs

@@ -96,6 +96,17 @@ export function createBuiltinToolSettings(
       saveConfigAndAdopt({ ...getConfig(), aiSessionTitles: enabled !== false });
       return this.getSessionTitleSettings();
     },
+    // Prompt-cache warming on/off (orchestrator session/cache-warm.mjs);
+    // default on. The warmer reads the saved value at each
+    // warm, so a change applies without a restart.
+    getCacheWarmingSettings() {
+      return { enabled: getConfig()?.promptCacheWarming !== false };
+    },
+    setCacheWarmingEnabled(enabled) {
+      if (typeof enabled !== 'boolean') throw new TypeError('cache warming must be on or off (a boolean)');
+      saveConfigAndAdopt({ ...getConfig(), promptCacheWarming: enabled });
+      return this.getCacheWarmingSettings();
+    },
     // The one pixel face every Lead row on the bot page wears, shared by every
     // device that follows this host. Only a mascot look counts; null (the
     // default grey pup) is stored as no key.

package/src/session-runtime/settings-compaction-api.mjs

@@ -6,38 +6,8 @@ import {
 import { isAutoClearUnlimited } from '../runtime/agent/orchestrator/runtime-core/config-helpers.mjs';
 import { COMPACTION_SUMMARY_MODES } from '../runtime/agent/orchestrator/session/compact/summary-mode.mjs';
 
-// Every spelling of the main-context buffer budget; a new representation
-// replaces the previous one.
-const MAIN_BUFFER_KEYS = [
-  'mainBufferTokens',
-  'mainBuffer',
-  'mainBufferPercent',
-  'mainBufferPct',
-  'mainBufferRatio',
-  'mainBufferFraction',
-];
-// Session-level compaction fields that the saved config owns from now on.
-const SESSION_COMPACTION_KEYS = [
-  'type',
-  'compactType',
-  'compact_type',
-  'semantic',
-  'semanticModel',
-  'prune',
-  'tailTurns',
-  'recallMemoryTimeoutMs',
-  'recallIngestLimit',
-  'recallChunkLimit',
-  'recallLimit',
-  'recallCycle1BatchSize',
-  'recallRowsPerSession',
-  'recallWindowSize',
-  'recallConcurrency',
-  'recallCycle1DeadlineMs',
-  // Replaced by summaryMode.
-  'useMaintainer',
-  ...MAIN_BUFFER_KEYS,
-];
+import { MAIN_BUFFER_KEYS } from '../runtime/agent/orchestrator/runtime-core/compaction-config-keys.mjs';
+import { adoptSessionCompaction } from './session-compaction-sync.mjs';
 
 // Unlimited (never auto-clear) typed as a duration.
 const UNLIMITED_DURATION = /^(?:unlimited|never)$/i;
@@ -66,14 +36,6 @@ function applyCompactionInput(next, input, hasOwn) {
   return next;
 }
 
-/** Replace the live session's compaction fields with the saved config's. */
-function adoptSessionCompaction(session, saved) {
-  if (!session) return;
-  const currentSessionCompaction = { ...(session.compaction || {}) };
-  for (const key of SESSION_COMPACTION_KEYS) delete currentSessionCompaction[key];
-  session.compaction = { ...currentSessionCompaction, ...saved };
-}
-
 // Advanced picker shows only providers the user actually has enabled
 // (config.providers[*].enabled), plus the active route provider, any
 // provider with a custom override, and the 'default' fallback row —

package/src/session-runtime/settings-system-api.mjs

@@ -1,5 +1,10 @@
 // Automation worker status, the system shell, self-update, Mixy's heartbeat
 // and bots' reactions settings.
+import {
+  normalizeHeartbeatIntervalMinutes,
+  requireHeartbeatIntervalMinutes,
+} from '../runtime/shared/heartbeat-interval.mjs';
+
 export function createSystemSettings({
   getConfig,
   saveConfigAndAdopt,
@@ -51,12 +56,19 @@ export function createSystemSettings({
       return this.getUpdateSettings();
     },
     getHeartbeatSettings() {
-      return { heartbeat: getConfig()?.heartbeat !== false };
+      return {
+        heartbeat: getConfig()?.heartbeat !== false,
+        intervalMinutes: normalizeHeartbeatIntervalMinutes(getConfig()?.heartbeatIntervalMinutes),
+      };
     },
     setHeartbeatEnabled(enabled) {
       saveConfigAndAdopt({ ...getConfig(), heartbeat: enabled === true });
       return this.getHeartbeatSettings();
     },
+    setHeartbeatInterval(minutes) {
+      saveConfigAndAdopt({ ...getConfig(), heartbeatIntervalMinutes: requireHeartbeatIntervalMinutes(minutes) });
+      return this.getHeartbeatSettings();
+    },
     getReactionSettings() {
       return { reactions: getConfig()?.reactions !== false };
     },