mixdog 1.3.5 → 1.4.1

package/src/session-runtime/lifecycle/teardown/runtime-stops.mjs

@@ -5,6 +5,17 @@
  * close, all-settled for a full one.
  */
 import { releaseComputerSession } from '../../../runtime/computer-bridge/client.mjs';
+import {
+  pendingSummaryIndexIds,
+  settleSummaryIndexWrites,
+} from '../../../runtime/agent/orchestrator/session/store-summary-index.mjs';
+import { settleGatewayUsageWrites } from '../../../runtime/agent/orchestrator/providers/statusline-route-meta.mjs';
+import { closeSessionSearch } from '../../../runtime/session-search/session-search-ingest.mjs';
+
+// How long a close waits for a stop that owns files (memory, goals, and the
+// close's own persistence): briefly for a detached close, longer for a full one.
+const DETACHED_FILE_STOP_MS = 1500;
+const FULL_FILE_STOP_MS = 5500;
 
 export function startRuntimeStops(deps, reason, { detach, isProcessExit }) {
   const { mcpClient, getMcpScopeId, closePatchRuntimeIfLoaded, getMemoryModPromise, setMemoryModPromise } = deps;
@@ -66,8 +77,8 @@ export async function settleDetached(withTeardownDeadline, stops) {
   const bounded = [
     [stops.channelStop, 300],
     [stops.shellJobsStop, 300],
-    [stops.memoryStop, 1500],
-    [stops.goalStop, 1500],
+    [stops.memoryStop, DETACHED_FILE_STOP_MS],
+    [stops.goalStop, DETACHED_FILE_STOP_MS],
   ];
   for (const [stop, deadlineMs] of bounded) {
     try {
@@ -79,14 +90,49 @@ export async function settleDetached(withTeardownDeadline, stops) {
   }
 }
 
+/**
+ * The close's deferred data-dir writes, under the file-stop deadline: this
+ * session's summary-index ops (every queued op when no session is closing),
+ * the buffered gateway usage events with their compaction, and this session's
+ * session-search writes (cancelled, PostgreSQL install included). Past the
+ * deadline the close stops waiting and reports what is still pending; those
+ * writes stay queued and land later.
+ */
+export async function settlePersistence(withTeardownDeadline, { detach, closingSessionId }) {
+  const ids = closingSessionId ? [closingSessionId] : null;
+  const giveUp = new AbortController();
+  const pending = new Set(['summary index', 'gateway usage', 'session search']);
+  const track = (name, work) =>
+    Promise.resolve(work).then((settled) => {
+      if (settled !== false) pending.delete(name);
+    });
+  const settled = await withTeardownDeadline(
+    Promise.all([
+      track('summary index', settleSummaryIndexWrites({ ids, signal: giveUp.signal })),
+      track('gateway usage', settleGatewayUsageWrites()),
+      track('session search', closingSessionId ? closeSessionSearch(closingSessionId) : null),
+    ]).then(() => true),
+    detach ? DETACHED_FILE_STOP_MS : FULL_FILE_STOP_MS,
+    false
+  );
+  if (settled) return;
+  giveUp.abort();
+  const detail = [...pending].map((name) =>
+    name === 'summary index' && ids ? `summary index (sessions: ${pendingSummaryIndexIds(ids).join(', ')})` : name
+  );
+  process.emitWarning(`close persistence incomplete; still pending: ${detail.join('; ')}`, {
+    code: 'TEARDOWN_PERSISTENCE_PENDING',
+  });
+}
+
 export async function settleAll(withTeardownDeadline, stops) {
   await Promise.allSettled([
     withTeardownDeadline(stops.channelStop, 5500, false),
     withTeardownDeadline(stops.mcpStop, 1500, false),
     withTeardownDeadline(stops.openaiWsStop, 1500, false),
     withTeardownDeadline(stops.patchStop, 1500, false),
-    withTeardownDeadline(stops.memoryStop, 5500, false),
-    withTeardownDeadline(stops.goalStop, 5500, false),
+    withTeardownDeadline(stops.memoryStop, FULL_FILE_STOP_MS, false),
+    withTeardownDeadline(stops.goalStop, FULL_FILE_STOP_MS, false),
     withTeardownDeadline(stops.shellJobsStop, 1500, false),
     withTeardownDeadline(stops.nativeToolStop, 1500, false),
     withTeardownDeadline(stops.computerStop, 1500, false),

package/src/session-runtime/lifecycle/teardown.mjs

@@ -11,7 +11,13 @@ import { flushAllIndexWrites } from '../services/agent-tool/index-write-queue.mj
 import { PROCESS_RESTART_FAILURE } from '../services/agent-tool/worker-index/row-liveness.mjs';
 import { unregisterLiveSession } from '../../runtime/shared/staged-update.mjs';
 import { abortRuntime, closeCanonicalSession, closeOwnSession, dispatchSessionEnd } from './teardown/session-close.mjs';
-import { settleAll, settleDetached, startRuntimeStops, startWorkStops } from './teardown/runtime-stops.mjs';
+import {
+  settleAll,
+  settleDetached,
+  settlePersistence,
+  startRuntimeStops,
+  startWorkStops,
+} from './teardown/runtime-stops.mjs';
 
 const CLOSE_ALL_DEADLINE_MS = 5000;
 const PROCESS_EXIT_REASON = /exit|quit|shutdown|sighup|sigint|sigterm/;
@@ -243,9 +249,22 @@ export function createTeardown(deps, { ingestSessionIntoMemory, closeSurfaceSess
     else await settleAll(withTeardownDeadline, stops);
     // Reported closed only once the barrier is on disk (closeSessionAsync),
     // and its write control is released only after that.
-    const ok = await ownClose;
-    // The session went away (idle eviction included): free its save baselines.
-    if (scope.closingSessionId) forgetSessionSaveBaseline(scope.closingSessionId, { releaseWriteControl: true });
+    let ok = false;
+    try {
+      ok = await ownClose;
+      // The session went away (idle eviction included): free its save baselines.
+      if (scope.closingSessionId) forgetSessionSaveBaseline(scope.closingSessionId, { releaseWriteControl: true });
+      // The close's saves and turns queued buffered data-dir writes (summary
+      // index ops, gateway usage events, session-search writes) that run on
+      // later ticks: land or cancel them under the teardown deadline.
+      await settlePersistence(withTeardownDeadline, scope);
+    } finally {
+      finishClose(scope);
+    }
+    return ok;
+  }
+
+  function finishClose(scope) {
     // Self-update stages in the background and swaps on the next clean launch
     // (see staged-update.mjs) — nothing installs at shutdown. On a real
     // process exit we just drop this session's live-refcount pid file so a
@@ -257,7 +276,6 @@ export function createTeardown(deps, { ingestSessionIntoMemory, closeSurfaceSess
         /* advisory refcount only */
       }
     }
-    return ok;
   }
 
   return {

package/src/session-runtime/mcp-glue/server-catalog.mjs

@@ -2,7 +2,14 @@
 // servers plus the servers registered plugins declare (resolved live, with
 // explicit owner metadata), per-server config reads, and the live/failed rollup.
 import { clean } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
-import { connectorOfServer, gmailAppPasswordAccount } from '../../runtime/shared/connector-catalog.mjs';
+import {
+  connectorAccountEnabled,
+  connectorAccountServer,
+  connectorAccountsOf,
+  connectorOfServer,
+  gmailAppPasswordAccount,
+} from '../../runtime/shared/connector-catalog.mjs';
+import { connectorAccountHealth } from '../../runtime/connectors/connector-accounts-mcp.mjs';
 import { googleOAuthClient } from '../../runtime/shared/google-oauth-client.mjs';
 import { envFlag } from '../../runtime/shared/env.mjs';
 import { resolveMcpServerCatalog } from './plugin-servers.mjs';
@@ -112,6 +119,25 @@ export function createMcpServerCatalog({
     };
   }
 
+  /** One account of a multi-account connector server, as its row lists it:
+   *  `{ name, email, enabled?, appPassword?, oauth?, ownClient?, error?, authRequired? }`
+   *  (`enabled: false` only for an account that is switched off). */
+  function accountRow(accountCfg, enabled) {
+    const address = gmailAppPasswordAccount(accountCfg);
+    const oauth = address ? null : mcpClient.getMcpServerOAuthState?.(accountCfg);
+    const state = connectorAccountHealth(accountCfg.name);
+    const authRequired = Boolean(oauth && oauth.signedIn !== true) || state?.authRequired === true;
+    return {
+      name: accountCfg.name,
+      ...(enabled ? {} : { enabled: false }),
+      email: address || oauth?.account || state?.email || '',
+      ...(address ? { appPassword: { account: address } } : {}),
+      ...(oauth ? { oauth } : {}),
+      ...(typeof accountCfg.oauthClientId === 'string' && accountCfg.oauthClientId.trim() ? { ownClient: true } : {}),
+      ...(authRequired ? { authRequired: true } : state?.error ? { error: state.error } : {}),
+    };
+  }
+
   function statusRows(catalog) {
     const { servers: configured, sources, entries } = catalog;
     const connected = new Map((mcpClient.getMcpServerStatus?.(getMcpScopeId()) || []).map((row) => [row.name, row]));
@@ -126,7 +152,19 @@ export function createMcpServerCatalog({
         failures.get(name) || (dead ? { msg: live.error || live.lastError || 'MCP server is not alive' } : undefined);
       const entry = entries[name] || {};
       const loginPending = !(live && !dead) && mcpClient.isMcpLoginPending?.(name, getMcpScopeId()) === true;
-      const status = mcpServerStatus(cfg, live && !dead, fail, loginPending);
+      const accounts = entry.owner
+        ? []
+        : connectorAccountsOf(cfg).map((account) =>
+            accountRow(connectorAccountServer(cfg, account), connectorAccountEnabled(account))
+          );
+      // A connector server none of whose accounts is signed in needs a sign-in, not a repair.
+      const accountsSignIn = accounts.length > 0 && accounts.every((account) => account.authRequired === true);
+      const status = mcpServerStatus(
+        cfg,
+        live && !dead,
+        fail && accountsSignIn ? { ...fail, authRequired: true } : fail,
+        loginPending
+      );
       // Needing an OAuth sign-in is a state, not an error.
       const authRequired = status === 'sign-in required';
       const row = {
@@ -156,6 +194,14 @@ export function createMcpServerCatalog({
       if (appPasswordAccount) row.appPassword = { account: appPasswordAccount };
       // A catalog connector running on the user's own Google client.
       if (connector && typeof cfg?.oauthClientId === 'string' && cfg.oauthClientId.trim()) row.ownClient = true;
+      if (accounts.length) {
+        // A multi-account connector: its accounts, each with its own state.
+        row.accounts = accounts;
+        if (accounts.some((account) => account.ownClient)) row.ownClient = true;
+        // One account reads like the one-account server it replaces.
+        if (accounts.length === 1 && accounts[0].oauth) row.oauth = accounts[0].oauth;
+        if (accounts.length === 1 && accounts[0].appPassword) row.appPassword = accounts[0].appPassword;
+      }
       if (entry.owner) {
         row.owner = entry.owner;
         row.pluginEnabled = entry.pluginEnabled;
@@ -175,7 +221,13 @@ export function createMcpServerCatalog({
 
   function mcpStatus() {
     if (envFlag('MIXDOG_DISABLE_MCP')) {
-      return { servers: [], configuredCount: 0, connectedCount: 0, failedCount: 0, googleClient: Boolean(googleOAuthClient()) };
+      return {
+        servers: [],
+        configuredCount: 0,
+        connectedCount: 0,
+        failedCount: 0,
+        googleClient: Boolean(googleOAuthClient()),
+      };
     }
     const catalog = resolveCatalog();
     const servers = statusRows(catalog);

package/src/session-runtime/mcp-oauth-login.mjs

@@ -8,7 +8,7 @@ import { openInBrowser } from '../runtime/shared/open-url.mjs';
 // Settled flows stay readable long enough for a poller to observe the result.
 const SETTLED_FLOW_TTL_MS = 10 * 60_000;
 const NOT_COMPLETED = 'MCP OAuth sign-in was not completed';
-export const MCP_OAUTH_LOGIN_TIMED_OUT = 'MCP OAuth sign-in timed out';
+const MCP_OAUTH_LOGIN_TIMED_OUT = 'MCP OAuth sign-in timed out';
 // A sign-in nobody finishes ends here, ahead of the OAuth layer's own 5-minute
 // abort, so its failure is reported as the timeout it is.
 const LOGIN_DEADLINE_MS = 5 * 60_000 - 10_000;
@@ -125,7 +125,9 @@ export function createMcpOAuthLogins({
     Promise.all([...flows.values()].filter((flow) => flow.owner === owner && flow.name === name).map(cancelFlow));
 
   async function begin(name, options = {}) {
-    const { openBrowser: hostBrowser, mode = 'connect' } = options || {};
+    // `beside`: run any mode through `switchAccount` (a sign-in beside the
+    // stored one, for an account that is not a server of its own).
+    const { openBrowser: hostBrowser, mode = 'connect', beside = false } = options || {};
     if (hostBrowser !== undefined && typeof hostBrowser !== 'boolean') {
       throw new TypeError('openBrowser must be a boolean');
     }
@@ -178,7 +180,7 @@ export function createMcpOAuthLogins({
       flow.done = (async () => {
         try {
           const outcome =
-            mode === 'switch'
+            mode === 'switch' || beside === true
               ? await switchAccount(name, launch, {
                   set abort(fn) {
                     flow.abort = fn;

package/src/session-runtime/mixy-heartbeat.mjs

@@ -1,6 +1,7 @@
 /**
- * Mixy's heartbeat: every 30 minutes, one check of what happened since the
- * last one, in three stages that each stop as early as they can.
+ * Mixy's heartbeat: at the user's chosen interval (heartbeatIntervalMinutes,
+ * 30 min / 1 h / 2 h / 4 h, default 1 h, read live at each tick), one check of
+ * what happened since the last one, in three stages that each stop as early as they can.
  *  1. Collect (no model): a bounded digest of what happened in the interval:
  *     sessions the user talks in with new activity (Lead sessions, bot chats,
  *     group rooms; never Mixy's own chat, the heartbeat's hidden sessions,
@@ -13,11 +14,13 @@
  *     still fails (once when it switched itself off); a success closes it.
  *  2. Gate: a digest equal to the last check's, or an empty one, ends the
  *     check. Otherwise the Maintainer model reviews each session and task
- *     line in its own call over that session's messages since its last
- *     review (tool calls left out), given that review's note (a few at a
- *     time; a session with no new item keeps its note without a call; a line
- *     it finds nothing in is dropped, its note is appended, a failed read or
- *     review keeps the line as collected), then answers once on the reviewed
+ *     line in its own call over the latest 12 of that session's messages
+ *     since its last review (tool calls left out), given that review's note
+ *     (a few at a time; the cursor then moves to the newest item and the line
+ *     says how many older messages went unreviewed, or that its cursor was
+ *     not found; a session with no new item keeps its note without a call; a
+ *     line it finds nothing in is dropped unless it says that, its note is
+ *     appended, a failed read or review keeps the line as collected), then answers once on the reviewed
  *     digest with Mixy's last delivered message of the past day
  *     (heartbeat-completion.mjs). Without one
  *     (it is off by default), after a
@@ -40,11 +43,17 @@
  * for, or a wake whose reply was delivered); a failed collection (any
  * source), Maintainer call or wake leaves them for the next check, and a
  * routine-only wake after a failed Maintainer call commits just its routine
- * warnings. A due check waits while the user is active (a turn they sent in
- * the last 10 minutes, as this process saw it or the state file kept it;
- * routine and other runtime-made turns are no user activity); missed checks run as one; two never run at once; the first one after
- * a start is looked at after a minute. The setting `heartbeat: false` (setup
- * set_heartbeat_enabled) stops it.
+ * warnings. A due check waits while the user is active: the user is idle only
+ * after 30 minutes with no operation, an operation being a turn they sent or
+ * an input (keyboard, mouse buttons, wheel, mouse movement) in the desktop
+ * app's own windows, which the app reports (noteUserInput), as this process
+ * saw it or the state file kept it. Input elsewhere on the machine, and
+ * routine and other runtime-made turns, are no user activity; without the
+ * desktop app only sent turns count. Missed checks run as one; two never run
+ * at once; the first one after a start is looked at after a minute. The setting `heartbeat: false` (setup
+ * set_heartbeat_enabled) stops it, and so does a representative bot that does
+ * not exist (mixy-presence.mjs, as the desktop shows her): no check runs
+ * and the watermark is cleared, so the first check once Mixy exists arms anew.
  *
  * Proposals Mixy makes (session action suggest) live in the same state file
  * under a stable key (action:target): the same key is refreshed, a declined
@@ -63,6 +72,10 @@ import { roomIdOfSession, roomMemberOfSession } from '../runtime/agent/orchestra
 import { isRootLeadSession } from '../runtime/agent/orchestrator/session/store-summary-visibility.mjs';
 import { writeJsonAtomicSync } from '../runtime/shared/atomic-file.mjs';
 import { resolvePluginData } from '../runtime/shared/plugin-paths.mjs';
+import {
+  DEFAULT_HEARTBEAT_INTERVAL_MINUTES,
+  normalizeHeartbeatIntervalMinutes,
+} from '../runtime/shared/heartbeat-interval.mjs';
 import { ROUTINE_LIMITS } from '../runtime/shared/routine-limits.mjs';
 import {
   HEARTBEAT_QUIET,
@@ -74,10 +87,11 @@ import { activityOf, isWorking, quotedText, scanCatalog, sessionBotOf } from './
 
 const HOUR = 60 * 60_000;
 export const HEARTBEAT_LIMITS = Object.freeze({
-  intervalMs: 30 * 60_000,
+  // The default interval; the setting decides (see `intervalMs` in createMixyHeartbeat).
+  intervalMs: DEFAULT_HEARTBEAT_INTERVAL_MINUTES * 60_000,
   firstTickMs: 60_000,
   tickMs: 5 * 60_000,
-  idleMs: 10 * 60_000,
+  idleMs: 30 * 60_000,
   repeatMs: 6 * HOUR,
   suggestionTtlMs: 72 * HOUR,
   maxPending: 5,
@@ -90,14 +104,21 @@ const MAX_UNRELEASED = 20;
 const MAX_LINES = { routine: 10, task: 8, session: 8 };
 const TEXT_LIMIT = 120;
 const DIGEST_LIMIT = 4000;
-/** A review reads a session's latest TAIL_ITEMS transcript items and keeps
- *  their last TAIL_MESSAGES user and assistant messages, each cut to
- *  TAIL_TEXT_LIMIT; this many reviews run at once. */
+/** A review reads a session's latest TAIL_ITEMS transcript items and takes
+ *  the latest TAIL_MESSAGES user and assistant messages after its cursor, each
+ *  cut to TAIL_TEXT_LIMIT, in one model call; this many reviews run at once. */
 const TAIL_ITEMS = 40;
 const TAIL_MESSAGES = 12;
 const TAIL_TEXT_LIMIT = 400;
 const REVIEWS_AT_ONCE = 4;
 const NOTE_LIMIT = 300;
+/** What a digest line says of the messages a review left out (readSessionTail). */
+function skippedNote({ skipped = 0, exact = true } = {}) {
+  if (skipped < 0) return 'older messages since the last check could not be found, so some were not reviewed';
+  if (skipped === 0) return exact ? '' : 'older messages since the last check may not have been reviewed';
+  const count = `${exact ? '' : 'at least '}${skipped}`;
+  return `${count} older message${skipped === 1 && exact ? '' : 's'} since the last check ${skipped === 1 && exact ? 'was' : 'were'} not reviewed`;
+}
 /** Each reviewed session's cursor (its newest item) and note, kept this long
  *  and at most this many. */
 const REVIEW_TTL_MS = 7 * 24 * HOUR;
@@ -130,6 +151,61 @@ export function noteUserTurn(at = Date.now(), { path = defaultStatePath() } = {}
   });
 }
 
+let lastAppInputAt = 0;
+/** Per state file: the app input time last written, when it was written and
+ *  the trailing write waiting for the end of the window (if any). */
+const appInputWrites = new Map();
+const APP_INPUT_WRITE_MS = 60_000;
+function writeAppInput(path, entry, current) {
+  if (entry.timer) clearTimeout(entry.timer);
+  entry.timer = null;
+  const value = lastAppInputAt;
+  updateState(path, (next) => {
+    next.lastAppInputAt = Math.max(next.lastAppInputAt, value);
+  });
+  entry.at = value;
+  entry.wroteAt = current;
+}
+/** The latest time the user operated the desktop app (keyboard, mouse buttons,
+ *  wheel or mouse movement over its windows), as the app reports it (session
+ *  action noteUserInput). Memory always takes the max (a time in the future
+ *  counts as now). The state file (`lastAppInputAt`) is written only when the
+ *  value advanced and at most once a minute, whoever calls. A note inside the
+ *  window schedules one trailing write (an unref'd timer) of the newest value
+ *  at the window's end, so after input stops the file is at most a minute
+ *  behind: a crash loses at most the last minute of input, and a restart may
+ *  see it up to a minute older than it was. The first note of a process
+ *  writes at once. */
+export function noteUserInput(
+  at = Date.now(),
+  { path = defaultStatePath(), now = Date.now, schedule = setTimeout } = {}
+) {
+  const current = now();
+  const time = Math.min(Number(at) || 0, current);
+  lastAppInputAt = Math.max(lastAppInputAt, time);
+  let entry = appInputWrites.get(path);
+  if (!entry) {
+    entry = { at: 0, wroteAt: 0, timer: null };
+    appInputWrites.set(path, entry);
+  }
+  if (lastAppInputAt <= entry.at) return;
+  const waited = current - entry.wroteAt;
+  if (entry.wroteAt && waited < APP_INPUT_WRITE_MS) {
+    if (entry.timer) return;
+    const held = entry;
+    held.timer = schedule(
+      () => {
+        held.timer = null;
+        if (lastAppInputAt > held.at) writeAppInput(path, held, now());
+      },
+      Math.min(APP_INPUT_WRITE_MS, APP_INPUT_WRITE_MS - waited)
+    );
+    held.timer?.unref?.();
+    return;
+  }
+  writeAppInput(path, entry, current);
+}
+
 const defaultStatePath = () => join(resolvePluginData(), 'heartbeat.json');
 
 function readState(path) {
@@ -144,6 +220,8 @@ function readState(path) {
     lastAttemptAt: Number(value.lastAttemptAt) || 0,
     // The user's latest accepted turn (noteUserTurn), for the idle check.
     lastUserInputAt: Number(value.lastUserInputAt) || 0,
+    // The user's latest operation inside the desktop app (noteUserInput).
+    lastAppInputAt: Number(value.lastAppInputAt) || 0,
     // Approvals waiting at the last handled check.
     approvals: Number.isInteger(value.approvals) && value.approvals > 0 ? value.approvals : 0,
     lastHash: typeof value.lastHash === 'string' ? value.lastHash : '',
@@ -418,24 +496,33 @@ export function isQuietReply(reply) {
 }
 
 /** Session `id`'s latest conversation for a review, oldest first:
- *  `{ rows, head }`, a line per user or assistant message (tool calls left
- *  out; at most TAIL_MESSAGES, the newest), only those after item `after`
- *  when the window holds it, and `head` the id of its newest item ('' when
- *  the items carry none). Rejects when the session cannot be read. */
+ *  `{ rows, head, skipped, exact }`. One read of the latest TAIL_ITEMS items
+ *  (never more, however many tool calls they hold); `rows` is a line per
+ *  user or assistant message (tool calls left out), the newest TAIL_MESSAGES
+ *  after item `after` in that page. `skipped` is the number of older messages
+ *  in the page left unreviewed: exact when the cursor is in the page, else a
+ *  lower bound (`exact` false) when older items lie beyond the page; a
+ *  supplied cursor absent from a page with nothing older is `-1` (it was
+ *  compacted away: the gap is unknown). `head` is the id of the newest item
+ *  ('' when the items carry none). Rejects when the session cannot be read. */
 export async function readSessionTail(service, id, { after = '' } = {}) {
   if (typeof service?.readSession !== 'function') throw new Error('the session service is not running');
   const { range } = await service.readSession({ sessionId: id, transcriptRange: { offset: 0, limit: TAIL_ITEMS } });
   const items = range?.items || [];
+  const hasOlder = range?.hasOlder === true;
   const ids = items.map((item) => (item?.id == null ? '' : String(item.id)));
   const head = ids.findLast(Boolean) || '';
   const seen = after ? ids.lastIndexOf(after) : -1;
-  const rows = [];
+  const all = [];
   for (const item of items.slice(seen + 1)) {
     if (item?.kind !== 'user' && item?.kind !== 'assistant') continue;
     const text = quotedText(item.text, TAIL_TEXT_LIMIT);
-    if (text) rows.push(`${item.kind}: "${text}"`);
+    if (text) all.push(`${item.kind}: "${text}"`);
   }
-  return { rows: rows.slice(-TAIL_MESSAGES), head };
+  const rows = all.slice(-TAIL_MESSAGES);
+  const skipped = all.length - rows.length;
+  if (after && seen < 0 && !hasOlder) return { rows, head, skipped: -1, exact: false };
+  return { rows, head, skipped, exact: after ? seen >= 0 : !hasOlder };
 }
 
 /** Run `work` on every row, at most `limit` at once. */
@@ -549,7 +636,16 @@ export function createMixyHeartbeat({
   path = defaultStatePath(),
   isEnabled = async () =>
     (await import('../runtime/agent/orchestrator/config.mjs')).loadConfig({ secrets: false }).heartbeat !== false,
+  // Whether the representative bot exists (mixy-presence.mjs, the rule the
+  // desktop and her routines follow): without it no check runs at all.
+  mixyExists = async () => (await import('./routine-owner.mjs')).readMixyExists(),
+  // Milliseconds between checks, read at every tick so a changed setting applies at once.
+  intervalMs = async () =>
+    normalizeHeartbeatIntervalMinutes(
+      (await import('../runtime/agent/orchestrator/config.mjs')).loadConfig({ secrets: false }).heartbeatIntervalMinutes
+    ) * 60_000,
   userTurnAt = () => lastUserTurnAt,
+  appInputAt = () => lastAppInputAt,
   getSessionService = () => null,
   log = defaultLog,
   collect = (input) => collectHeartbeatFacts({ ...input, getSessionService }),
@@ -561,7 +657,7 @@ export function createMixyHeartbeat({
     (await import('../runtime/agent/orchestrator/agent-runtime/heartbeat-completion.mjs')).reviewHeartbeatSession(
       input
     ),
-  readTail = (id) => readSessionTail(getSessionService(), id),
+  readTail = (id, options) => readSessionTail(getSessionService(), id, options),
   release = closeHiddenSession,
   // `hooks`: how the hidden session is closed, and where a failed close goes.
   wake = (input, hooks) => wakeMixy(input, { getSessionService, log, ...hooks }),
@@ -642,9 +738,15 @@ export function createMixyHeartbeat({
     const lines = [...digest.lines];
     const dropped = new Set();
     const cursors = {};
-    const apply = (index, note) => {
-      if (!note) dropped.add(index);
-      else lines[index] = `${lines[index]}; reviewed: "${quotedText(note, NOTE_LIMIT)}"`;
+    // A line whose older messages went unreviewed is never dropped as
+    // "nothing": it says so, as the overflow lines count what they leave out.
+    const apply = (index, note, skipped = '') => {
+      if (!note && !skipped) {
+        dropped.add(index);
+        return;
+      }
+      const noted = note ? `${lines[index]}; reviewed: "${quotedText(note, NOTE_LIMIT)}"` : lines[index];
+      lines[index] = skipped ? `${noted}; ${skipped}` : noted;
     };
     await eachLimited(digest.subjects, REVIEWS_AT_ONCE, async ({ index, id }) => {
       const prior = state.reviews[id];
@@ -656,6 +758,8 @@ export function createMixyHeartbeat({
           apply(index, prior.note);
           return;
         }
+        // The latest messages since the cursor, in one call; the cursor then
+        // moves to the newest item, and what lay before them is said so.
         result = await review({ line: digest.lines[index], transcript: tail.rows, previous: prior?.note || '' });
       } catch (error) {
         log(`review of ${id} failed: ${errorText(error)}`);
@@ -663,7 +767,7 @@ export function createMixyHeartbeat({
       }
       if (result?.action === 'nothing' || result?.action === 'note') {
         const note = result.action === 'note' ? result.text : '';
-        apply(index, note);
+        apply(index, note, skippedNote(tail));
         if (tail.head) cursors[id] = { head: tail.head, note };
       } else if (result?.action !== 'unmanaged') log(`review of ${id}: unusable reply`);
     });
@@ -759,6 +863,16 @@ export function createMixyHeartbeat({
     try {
       await retryReleases();
       if (!(await isEnabled())) return 'off';
+      // No Maintainer call, hidden turn or queued report for a Mixy the user
+      // never created (issue #243); the first check after she is made arms anew.
+      if (!(await mixyExists())) {
+        if (readState(path).lastBeatAt) {
+          updateState(path, (next) => {
+            next.lastBeatAt = 0;
+          });
+        }
+        return 'no-mixy';
+      }
       const at = now();
       const state = readState(path);
       if (!state.lastBeatAt) {
@@ -769,10 +883,16 @@ export function createMixyHeartbeat({
       }
       // Checks are due by the last one begun; a check left unhandled keeps
       // its watermark, so the next one collects its changes again.
-      if (at - Math.max(state.lastBeatAt, state.lastAttemptAt) < limits.intervalMs) return 'waiting';
-      // The user's latest turn: one this process saw, or the state file's
-      // record of it (it survives a crash or restart).
-      const userAt = Math.max(Number(userTurnAt()) || 0, state.lastUserInputAt);
+      if (at - Math.max(state.lastBeatAt, state.lastAttemptAt) < (await intervalMs())) return 'waiting';
+      // The user's latest operation: a turn they sent or an input in the
+      // desktop app, as this process saw it or the state file kept it (it
+      // survives a crash or restart).
+      const userAt = Math.max(
+        Number(userTurnAt()) || 0,
+        Number(appInputAt()) || 0,
+        state.lastUserInputAt,
+        state.lastAppInputAt
+      );
       if (at - userAt < limits.idleMs) return 'deferred';
       updateState(path, (next) => {
         next.lastAttemptAt = at;

package/src/session-runtime/model-route/set-route.mjs

@@ -217,11 +217,20 @@ function switchSessionInPlace(deps, session) {
 
 /** The Lead's fallback models after this selection, checked like an agent's
  *  chain (leaf routes, distinct providers): an explicit list replaces the
- *  stored one ([] clears it), a selection without one keeps it. */
+ *  stored one ([] clears it), a selection without one keeps it as stored — a
+ *  fallback on the new main model's provider stays saved and is inactive
+ *  (executionFallbacks). */
 async function leadFallbackChain(deps, next, primary) {
   const storedPreset = findPreset(deps.getConfig(), workflowPresetId('lead'));
-  const requested = hasOwn(next || {}, 'fallbacks') ? next.fallbacks : storedPreset?.fallbacks;
+  const explicit = hasOwn(next || {}, 'fallbacks');
+  const requested = explicit ? next.fallbacks : storedPreset?.fallbacks;
   if (!Array.isArray(requested) || !requested.length) return [];
+  if (!explicit) {
+    return (
+      normalizeWorkflowRoute({ provider: primary.provider, model: primary.model, fallbacks: requested })?.fallbacks ||
+      []
+    );
+  }
   const chain = routeChain({ provider: primary.provider, model: primary.model, fallbacks: requested });
   validateRouteChainProviders(chain);
   const storedChain = routeChain(storedPreset || {});