mixdog 1.3.5 → 1.4.1

package/src/session-runtime/services/agent-tool/worker-index/row-reads.mjs

@@ -0,0 +1,36 @@
+// worker-index/row-reads.mjs
+// Scoped reads of the worker rows and tag tombstones: a row a tombstone still
+// blocks never reads as work, and a legacy tombstone without an owner takes
+// the one its session resolves to.
+import { clean, rowMatchesContext } from '../helpers.mjs';
+import { recoverTagTombstoneOwner } from '../worker-rows.mjs';
+import {
+  findTagTombstone,
+  tagTombstoneKey,
+  tombstoneBlocksWork,
+} from '../../../../runtime/shared/agent-reap-state.mjs';
+
+export function createWorkerRowReads(store, mgr) {
+  function readWorkerRows(context = {}) {
+    const { rows, tombstones: savedTombstones } = store.readSnapshot();
+    if (rows.length === 0) return rows;
+    const tombstones = new Map(recoverTombstoneOwners(savedTombstones).map((row) => [tagTombstoneKey(row), row]));
+    return rows.filter(
+      (row) => rowMatchesContext(row, context) && !tombstoneBlocksWork(row, findTagTombstone(row, tombstones))
+    );
+  }
+
+  function readAllTagTombstones() {
+    return recoverTombstoneOwners(store.readTombstones());
+  }
+
+  function recoverTombstoneOwners(rows) {
+    if (!rows.some((row) => !clean(row.parentSessionId || row.ownerSessionId))) return rows;
+    const sessions = typeof mgr.listSessions === 'function' ? mgr.listSessions({ includeClosed: true }) : [];
+    // Resolve legacy ownership against all sessions, never just the caller's
+    // scope: filtering first would conceal an ambiguous sibling owner.
+    return rows.map((row) => recoverTagTombstoneOwner(row, sessions));
+  }
+
+  return { readWorkerRows, readAllTagTombstones };
+}

package/src/session-runtime/services/agent-tool/worker-index/row-shape.mjs

@@ -65,6 +65,8 @@ export function normalizeWorkerRows(value) {
       // Additive and transient: present only while the worker's turn waits on
       // a user approval (worker-index setAwaitingUser).
       ...(row.awaitingUser === 'approval' ? { awaitingUser: 'approval' } : {}),
+      // Present only on an agent its owner closed (the agent tool's `close`).
+      ...(row.released === true ? { released: true } : {}),
     }))
     .filter((row) => !isLeadPoolAgent(row.agent) && keepWorkerRow(row));
 }

package/src/session-runtime/services/agent-tool/worker-index/row-store.mjs

@@ -4,10 +4,11 @@
 // worker index of a process over one file shares one store (acquireWorkerRowStore),
 // so all of them serialize through the same projection and queue.
 import { readFileSync, statSync } from 'node:fs';
-import { resolve } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 
 import { createIndexWriteQueue } from '../index-write-queue.mjs';
 import { normalizeTagTombstones, tagTombstoneKey, workerRowKey } from '../worker-rows.mjs';
+import { RELEASED_FILE, createReleasedStore } from './released-store.mjs';
 import { settleAwaitingUser } from './approval-wait.mjs';
 import { keepWorkerRow, normalizeWorkerRows } from './row-shape.mjs';
 
@@ -62,6 +63,9 @@ function rewriteIndexDocument(cur, mutator) {
 
 /** `file` may be null (no data dir): reads are empty and writes are no-ops. */
 export function createWorkerRowStore(file) {
+  // The release markers live in their own file beside the index, so a writer
+  // that rebuilds the index document never drops them.
+  const released = createReleasedStore(file ? join(dirname(file), RELEASED_FILE) : null);
   // Mtime-keyed parse cache. A single spawn calls refreshTagsFromSessions /
   // resolveTag / nextTag, which each re-read and re-parse this file; across a
   // parallel fanout that is O(spawns^2) synchronous reads of the same bytes.
@@ -148,18 +152,27 @@ export function createWorkerRowStore(file) {
     readAll,
     readSnapshot,
     readTombstones,
+    isReleased: released.isReleased,
+    markReleased: released.mark,
+    clearReleased: released.clear,
     write,
     /** Conditional field update: `mutator` runs now on the projection and again
      *  on the locked document when persisted, so its condition is re-checked
      *  against what is on disk. The one writer of `awaitingUser`. */
     update: (mutator) => queue.write(mutator, { rerun: true }),
     /** Resolves once every write so far is on disk. */
-    flush: queue.flush,
+    flush: async () => {
+      await Promise.all([queue.flush(), released.flush()]);
+    },
     /** Exit path: persist what is still queued, synchronously. */
-    flushSync: queue.flushSync,
-    hasUnpersisted: queue.hasUnpersisted,
+    flushSync: () => {
+      const flushed = [queue.flushSync(), released.flushSync()];
+      return flushed.every(Boolean);
+    },
+    hasUnpersisted: () => queue.hasUnpersisted() || released.hasUnpersisted(),
     invalidate: () => {
       dirty = true;
+      released.invalidate();
     },
   };
 }

package/src/session-runtime/services/agent-tool/worker-index/row-writes.mjs

@@ -0,0 +1,58 @@
+// worker-index/row-writes.mjs
+// Row upserts (immediate or batched), removal, and the owner's release mark:
+// every upsert projects the row into the tag maps (`bindTag`), tracks whether
+// this process runs it, and brings its approval wait in step.
+import { clean } from '../helpers.mjs';
+import { applyWorkerRowUpsert, workerRowKey } from '../worker-rows.mjs';
+import { isUnnotifiedRestartFailure } from './row-liveness.mjs';
+import { normalizeWorkerRows, workerRowFromSession } from './row-shape.mjs';
+
+export function createWorkerRowWrites({ file, store, batch, mgr, bindTag, settlement, awaitingUser }) {
+  function upsertWorkerRow(row, { defer = false } = {}) {
+    const normalized = normalizeWorkerRows({ workers: [row] })[0];
+    if (!normalized) return false;
+    const key = workerRowKey(normalized);
+    settlement.trackActiveRow(key, normalized);
+    bindTag(normalized);
+    if (defer) {
+      if (!file) return false;
+      awaitingUser.deferReconcile(normalized.sessionId);
+      return batch.queue((byKey) => applyWorkerRowUpsert(byKey, normalized));
+    }
+    store.write((byKey) => {
+      applyWorkerRowUpsert(byKey, normalized);
+    });
+    awaitingUser.reconcileAwaitingUser(normalized.sessionId);
+    return true;
+  }
+
+  // A session its owner closed keeps `released` on every row written for it,
+  // until a turn starts on it.
+  const rowFromSession = (session, fallbackTag = '', extra = {}) => {
+    const row = workerRowFromSession(session, fallbackTag, extra, (sessionId) => mgr.getSessionRuntime?.(sessionId));
+    return row && store.isReleased(row.sessionId) ? { ...row, released: true } : row;
+  };
+
+  /** Persist that the owner closed these sessions (survives a restart). */
+  function markReleased(sessionIds) {
+    store.markReleased(sessionIds.map(clean).filter(Boolean));
+  }
+
+  // A row whose owner is still owed its restart failure stays: closing the
+  // worker (a process exit closes every one) must not lose that result.
+  function removeWorkerRow({ tag = '', sessionId = '' } = {}) {
+    const targetTag = clean(tag);
+    const targetSessionId = clean(sessionId);
+    batch.flush();
+    store.write((byKey) => {
+      for (const [key, row] of [...byKey.entries()]) {
+        if (isUnnotifiedRestartFailure(row)) continue;
+        if ((targetSessionId && row.sessionId === targetSessionId) || (targetTag && row.tag === targetTag)) {
+          byKey.delete(key);
+        }
+      }
+    });
+  }
+
+  return { upsertWorkerRow, rowFromSession, markReleased, removeWorkerRow };
+}

package/src/session-runtime/services/agent-tool/worker-index.mjs

@@ -6,71 +6,33 @@
 //   row-store      — the file, its parse cache, the locked writer
 //   mutation-batch — spawn-path writes coalesced onto one immediate
 //   row-liveness   — stale-active detection and idle settlement
+//   row-reads          — scoped row and tag-tombstone reads
+//   row-writes         — upserts, removal, the owner's release mark
+//   awaiting-user-sync — approval waits kept in step with the runtime
+//   restart-settlement — rows a process exit or restart ended
+//   disposal           — drain, then release the registrations
 import { resolve } from 'node:path';
 
 import { WORKER_INDEX_FILE } from './tool-def.mjs';
-import { clean, positiveInt, registerExitFlush, rowMatchesContext } from './helpers.mjs';
-import { applyWorkerRowUpsert, recoverTagTombstoneOwner, workerRowKey } from './worker-rows.mjs';
-import {
-  applyAwaitingUser,
-  awaitingUserWouldChange,
-  clearAwaitingUser,
-  registerApprovalWaitWriter,
-} from './worker-index/approval-wait.mjs';
+import { registerExitFlush, rowMatchesContext } from './helpers.mjs';
+import { registerApprovalWaitWriter } from './worker-index/approval-wait.mjs';
+import { createAwaitingUserSync } from './worker-index/awaiting-user-sync.mjs';
+import { createIndexDisposal } from './worker-index/disposal.mjs';
 import { createMutationBatch } from './worker-index/mutation-batch.mjs';
-import {
-  createRowLiveness,
-  isActiveWorkerRow,
-  isStaleApprovalWait,
-  isUnnotifiedRestartFailure,
-  PROCESS_RESTART_FAILURE,
-  runtimeDied,
-} from './worker-index/row-liveness.mjs';
-import { normalizeWorkerRows, workerRowFromSession } from './worker-index/row-shape.mjs';
+import { createRestartSettlement } from './worker-index/restart-settlement.mjs';
+import { createWorkerRowReads } from './worker-index/row-reads.mjs';
 import { acquireWorkerRowStore } from './worker-index/row-store.mjs';
-import { findTagTombstone, tagTombstoneKey, tombstoneBlocksWork } from '../../../runtime/shared/agent-reap-state.mjs';
+import { createWorkerRowWrites } from './worker-index/row-writes.mjs';
+import { onSessionTurnStart } from '../../../runtime/shared/session-activity-signal.mjs';
 
 export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCwds }) {
   const file = dataDir ? resolve(dataDir, WORKER_INDEX_FILE) : null;
   // Shared with every other worker index of this process over the same file.
   const { store, release: releaseStore } = acquireWorkerRowStore(file);
-  // Sessions whose deferred rows still wait in the batch; reconciled once the
-  // batch lands in the store.
-  const unreconciled = new Set();
-  const batch = createMutationBatch(store.write, () => {
-    const ids = [...unreconciled];
-    unreconciled.clear();
-    for (const id of ids) reconcileAwaitingUser(id);
-  });
-  const liveness = createRowLiveness({
-    cfgMod,
-    isSessionRunning: (sessionId) => mgr.isSessionTurnInFlight?.(sessionId) === true,
-  });
-  // Rows this process marked active; settled as failed on exit (their turn
-  // dies with the process) so a crash of the host never leaves them
-  // "running" forever.
-  const activeWorkerKeys = new Set();
-
-  function readWorkerRows(context = {}) {
-    const { rows, tombstones: savedTombstones } = store.readSnapshot();
-    if (rows.length === 0) return rows;
-    const tombstones = new Map(recoverTombstoneOwners(savedTombstones).map((row) => [tagTombstoneKey(row), row]));
-    return rows.filter(
-      (row) => rowMatchesContext(row, context) && !tombstoneBlocksWork(row, findTagTombstone(row, tombstones))
-    );
-  }
-
-  function readAllTagTombstones() {
-    return recoverTombstoneOwners(store.readTombstones());
-  }
-
-  function recoverTombstoneOwners(rows) {
-    if (!rows.some((row) => !clean(row.parentSessionId || row.ownerSessionId))) return rows;
-    const sessions = typeof mgr.listSessions === 'function' ? mgr.listSessions({ includeClosed: true }) : [];
-    // Resolve legacy ownership against all sessions, never just the caller's
-    // scope: filtering first would conceal an ambiguous sibling owner.
-    return rows.map((row) => recoverTagTombstoneOwner(row, sessions));
-  }
+  const awaitingUser = createAwaitingUserSync(store, mgr);
+  const batch = createMutationBatch(store.write, awaitingUser.reconcileDeferred);
+  const settlement = createRestartSettlement({ store, cfgMod, mgr });
+  const { readWorkerRows, readAllTagTombstones } = createWorkerRowReads(store, mgr);
 
   // Every upsert also projects the row into the in-memory tag maps so tag
   // lookups never wait on a disk round-trip.
@@ -80,68 +42,20 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
     if (row.cwd) tagCwds.set(row.tag, row.cwd);
   }
 
-  function upsertWorkerRow(row, { defer = false } = {}) {
-    const normalized = normalizeWorkerRows({ workers: [row] })[0];
-    if (!normalized) return false;
-    const key = workerRowKey(normalized);
-    if (isActiveWorkerRow(normalized)) activeWorkerKeys.add(key);
-    else activeWorkerKeys.delete(key);
-    bindTag(normalized);
-    if (defer) {
-      if (!file) return false;
-      unreconciled.add(normalized.sessionId);
-      return batch.queue((byKey) => applyWorkerRowUpsert(byKey, normalized));
-    }
-    store.write((byKey) => {
-      applyWorkerRowUpsert(byKey, normalized);
-    });
-    reconcileAwaitingUser(normalized.sessionId);
-    return true;
-  }
-
-  const rowFromSession = (session, fallbackTag = '', extra = {}) =>
-    workerRowFromSession(session, fallbackTag, extra, (sessionId) => mgr.getSessionRuntime?.(sessionId));
-
-  // A row whose owner is still owed its restart failure stays: closing the
-  // worker (a process exit closes every one) must not lose that result.
-  function removeWorkerRow({ tag = '', sessionId = '' } = {}) {
-    const targetTag = clean(tag);
-    const targetSessionId = clean(sessionId);
-    batch.flush();
-    store.write((byKey) => {
-      for (const [key, row] of [...byKey.entries()]) {
-        if (isUnnotifiedRestartFailure(row)) continue;
-        if ((targetSessionId && row.sessionId === targetSessionId) || (targetTag && row.tag === targetTag)) {
-          byKey.delete(key);
-        }
-      }
-    });
-  }
-
-  /** Persist (or clear) a worker's approval wait as a field update fenced to
-   *  the session and its turn (`turnAt`, ms): a row whose turn started later is
-   *  left alone. Writes only when a row of that session exists and would
-   *  change, so a Lead's own approvals cost nothing; a row that is not in the
-   *  store yet takes the wait when it lands (reconcileAwaitingUser). */
-  function setAwaitingUser(sessionId, awaitingUser, { turnAt = 0 } = {}) {
-    const fence = {
-      sessionId: clean(sessionId),
-      awaitingUser: awaitingUser === 'approval' ? 'approval' : null,
-      turnAt: Number(turnAt) || 0,
-    };
-    if (!fence.sessionId || !awaitingUserWouldChange(store.readAll(), fence)) return false;
-    store.update((byKey) => applyAwaitingUser(byKey, fence));
-    return true;
-  }
+  const { upsertWorkerRow, rowFromSession, markReleased, removeWorkerRow } = createWorkerRowWrites({
+    file,
+    store,
+    batch,
+    mgr,
+    bindTag,
+    settlement,
+    awaitingUser,
+  });
 
-  /** The runtime of a session this process runs is the authority on its
-   *  approval wait (the runtime-liveness counter behind `awaitingUser`): every
-   *  row it creates or refreshes takes that state, so a missed or stale
-   *  transition heals on the next write. No runtime here: not ours to judge. */
-  function reconcileAwaitingUser(sessionId) {
-    const runtime = mgr.getSessionRuntime?.(sessionId);
-    if (runtime) setAwaitingUser(sessionId, runtime.awaitingUser, { turnAt: runtime.askStartedAt });
-  }
+  // The one boundary every turn start passes through (user input, an answer,
+  // auto-resume, a send, a room/bot turn): the session is in use again, for
+  // good, whatever started the turn.
+  const stopTurnStartListener = onSessionTurnStart((sessionId) => store.clearReleased(sessionId));
 
   function refreshTagsFromIndex(context = {}) {
     const rows = readWorkerRows(context);
@@ -149,142 +63,27 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
     return rows;
   }
 
-  function flushActiveWorkerRows() {
-    if (!activeWorkerKeys.size) return;
-    const keys = [...activeWorkerKeys];
-    activeWorkerKeys.clear();
-    const now = Date.now();
-    store.write((byKey) => {
-      for (const key of keys) {
-        const current = byKey.get(key);
-        if (!current || positiveInt(current.runtimePid) !== process.pid) continue;
-        if (isActiveWorkerRow(current)) {
-          byKey.set(key, liveness.failedRow(current, now, PROCESS_RESTART_FAILURE, true));
-        }
-      }
-    });
-  }
-
-  // Startup recovery: stale active rows settle — as failed when another
-  // process ran their turn (it is gone, or is the predecessor still shutting
-  // down: either way the turn never finished), otherwise to idle — and an
-  // approval wait left behind by a runtime that is gone (daemon restart) is
-  // cleared. `deadOnly` (later sweeps) settles only rows whose runtime is
-  // provably dead, never a live process's quiet turn.
-  function recoverStaleWorkerRows({ deadOnly = false } = {}) {
-    const now = Date.now();
-    const rows = store.readAll();
-    const isStale = deadOnly
-      ? (row) => isActiveWorkerRow(row) && runtimeDied(row)
-      : (row) => liveness.isStaleActive(row, now);
-    const staleActive = rows.filter(isStale);
-    const staleWaits = rows.some(isStaleApprovalWait);
-    if (!staleActive.length && !staleWaits) return false;
-    if (staleActive.length) {
-      store.write((byKey) => {
-        for (const row of staleActive) {
-          const key = workerRowKey(row);
-          const current = byKey.get(key);
-          if (!current || !isStale(current)) continue;
-          const ranElsewhere = positiveInt(current.runtimePid) && positiveInt(current.runtimePid) !== process.pid;
-          byKey.set(
-            key,
-            ranElsewhere ? liveness.failedRow(current, now, PROCESS_RESTART_FAILURE) : liveness.idleRow(current, now)
-          );
-        }
-      });
-    }
-    if (staleWaits) store.update((byKey) => clearAwaitingUser(byKey, isStaleApprovalWait));
-    return true;
-  }
-
-  /** Rows whose turn a process restart ended and whose owner has not been told
-   *  yet — whoever settled the row (this process at startup, or the
-   *  predecessor's exit flush). Read-only: the caller enqueues the owner's
-   *  notification durably, THEN calls `markRestartNotified`, so a crash in
-   *  between retries (the notification's stable id makes the retry exactly-once). */
-  function pendingRestartFailures() {
-    return store.readAll().filter(isUnnotifiedRestartFailure);
-  }
-
-  /** Stamp these rows as told, once their notification is durably queued. */
-  function markRestartNotified(rows) {
-    const stamp = new Date().toISOString();
-    store.write((byKey) => {
-      for (const row of rows) {
-        const key = workerRowKey(row);
-        const current = byKey.get(key);
-        if (!current || !isUnnotifiedRestartFailure(current)) continue;
-        byKey.set(key, { ...current, restartNotified: stamp });
-      }
-    });
-  }
-
   function flushWorkerIndexOnExit() {
     batch.flush();
-    flushActiveWorkerRows();
+    settlement.flushActiveWorkerRows();
     // Writes are persisted by an async queue; the loop is gone at exit. This
     // is the best-effort last resort: a persist still running is left alone
     // (the graceful shutdown path drains before exit).
     store.flushSync();
   }
 
-  recoverStaleWorkerRows();
+  settlement.recoverStaleWorkerRows();
   const unregisterExitFlush = registerExitFlush(flushWorkerIndexOnExit);
-  const unregisterApprovalWaits = registerApprovalWaitWriter(file, setAwaitingUser);
-  let disposed = false;
-  let disposePromise = null;
+  const unregisterApprovalWaits = registerApprovalWaitWriter(file, awaitingUser.setAwaitingUser);
 
   function teardown() {
+    stopTurnStartListener();
     unregisterExitFlush();
     unregisterApprovalWaits();
     releaseStore();
   }
 
-  async function drainThenTeardown() {
-    batch.flush();
-    await store.flush();
-    teardown();
-  }
-
-  /** Persist queued rows, then release the exit registration. Active rows are
-   *  NOT settled: they are keyed by process pid, which every inline runtime in
-   *  the daemon shares, so settling here would idle other runtimes' workers.
-   *  When the sync flush cannot run (this process's async writer holds the
-   *  lock) the exit hook and store ref stay until the async drain settles. */
-  function dispose() {
-    if (disposed) return;
-    disposed = true;
-    let flushed = false;
-    try {
-      batch.flush();
-      flushed = store.flushSync();
-    } catch {}
-    if (flushed) {
-      teardown();
-      return;
-    }
-    disposePromise = drainThenTeardown().catch(reopenAfterFailedDrain);
-  }
-
-  /** A failed drain tears nothing down; allow a later dispose to retry it. */
-  function reopenAfterFailedDrain() {
-    disposed = false;
-    disposePromise = null;
-  }
-
-  /** Awaitable dispose: drain everything, then tear down. A failed drain
-   *  rejects and leaves the registrations in place. */
-  function disposeAsync() {
-    if (!disposePromise) {
-      disposed = true;
-      disposePromise = drainThenTeardown().catch((error) => {
-        reopenAfterFailedDrain();
-        throw error;
-      });
-    }
-    return disposePromise;
-  }
+  const { dispose, disposeAsync } = createIndexDisposal({ batch, store, teardown });
 
   return {
     dispose,
@@ -310,12 +109,13 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
     upsertWorkerSessionDeferred: (session, fallbackTag = '', extra = {}) =>
       upsertWorkerRow(rowFromSession(session, fallbackTag, extra), { defer: true }),
     removeWorkerRow,
-    setAwaitingUser,
+    markReleased,
+    setAwaitingUser: awaitingUser.setAwaitingUser,
     refreshTagsFromIndex,
-    flushActiveWorkerRows,
+    flushActiveWorkerRows: settlement.flushActiveWorkerRows,
     flushWorkerIndexOnExit,
-    recoverStaleWorkerRows,
-    pendingRestartFailures,
-    markRestartNotified,
+    recoverStaleWorkerRows: settlement.recoverStaleWorkerRows,
+    pendingRestartFailures: settlement.pendingRestartFailures,
+    markRestartNotified: settlement.markRestartNotified,
   };
 }

package/src/session-runtime/services/agent-tool/worker-rows.mjs

@@ -129,6 +129,9 @@ export function applyWorkerRowUpsert(byKey, normalized) {
       merged[field] = prev[field];
     }
   }
+  // A whole-row write carries the session's release state: a row written
+  // without it (the agent was reused) is no longer released.
+  if (normalized.released !== true) delete merged.released;
   // `awaitingUser` is not decided here: the worker row store keeps the current
   // row's flag across every whole-row write and drops it once the row settles.
   byKey.set(key, {

package/src/session-runtime/services/channel-admin.mjs

@@ -62,7 +62,6 @@ function normalizeChannelsConfig(raw = {}) {
   return {
     ...CHANNELS_DEFAULTS,
     ...stored,
-    access: { ...CHANNELS_DEFAULTS.access, ...(stored.access || {}) },
     webhook: { ...CHANNELS_DEFAULTS.webhook, ...(stored.webhook || {}) },
   };
 }
@@ -189,7 +188,7 @@ function parseAtDatetime(at) {
 
 // Map the store's def shape onto the flat display shape every schedule reader
 // (channelSetup, renderChannelStatus, TUI pickers) consumes: `.time` renders
-// the cron or the one-shot datetime, `.route` the channel/session target.
+// the cron or the one-shot datetime.
 function scheduleToDisplay(s, ownerProblem = '') {
   return {
     name: s.name,
@@ -202,7 +201,6 @@ function scheduleToDisplay(s, ownerProblem = '') {
     attachments: s.attachments || undefined,
     enabled: s.enabled !== false,
     instructions: s.prompt,
-    route: 'session',
     // The bot it belongs to: each run is a turn in that bot's chat.
     owner: s.ownerAgentId || MIXY_AGENT_ID,
     // Why it is paused for its owner (routine-owner.mjs); absent when it runs.
@@ -252,7 +250,8 @@ function scheduleOwner(owner, existing) {
   return existing?.ownerAgentId || MIXY_AGENT_ID;
 }
 
-/** Each owner's problem (routine-owner.mjs), probed once per owner. */
+/** Each owner's problem (routine-owner.mjs) for its stored rows, probed once
+ *  per owner. */
 function ownerProblems() {
   const seen = new Map();
   return (ownerAgentId) => {
@@ -260,7 +259,7 @@ function ownerProblems() {
     if (!seen.has(owner))
       seen.set(
         owner,
-        routineOwnerProblem(owner).catch(() => '')
+        routineOwnerProblem(owner, null, { stored: true }).catch(() => '')
       );
     return seen.get(owner);
   };
@@ -350,8 +349,6 @@ export async function saveSchedule(
     whenCron,
     whenAt,
     timezone: scheduleTimezone,
-    target: 'session',
-    channelId: null,
     cwd: cwd ? String(cwd).trim() : null,
     attachments: normalizeAutomationAttachments(attachments),
     delivery: 'app',
@@ -408,7 +405,6 @@ async function listWebhooks() {
     secretSet: ep.secretSet === true,
     secret: undefined,
     instructions: ep.instructions,
-    route: 'session',
     // The bot it belongs to: each run is a turn in that bot's chat.
     owner: ep.ownerAgentId || MIXY_AGENT_ID,
     ...(problems[index] ? { ownerProblem: problems[index] } : {}),
@@ -461,7 +457,6 @@ export async function saveWebhook({
     name: id,
     description: String(description || '').trim(),
     parser: nextParser,
-    channelId: null,
     cwd: cwd ? String(cwd).trim() : null,
     attachments: normalizeAutomationAttachments(attachments),
     delivery: 'app',
@@ -578,9 +573,8 @@ export async function testWebhook(name) {
 }
 
 // Automation presence: any enabled schedule or webhook endpoint. Drives the
-// worker boot decision independently of the messaging channels — schedules
-// and webhooks run sessions, so they must not require Discord/Telegram
-// tokens or an explicit remote toggle.
+// worker boot decision — schedules and webhooks run sessions, so they must
+// not require an explicit remote toggle.
 async function checkActiveAutomation() {
   const { schedules, webhooks } = await readAutomationRows();
   return hasEnabledAutomation({ schedules, webhooks });
@@ -603,7 +597,7 @@ async function readAutomationRows() {
 // at once; writes from other processes are picked up after ttlMs. A failed
 // check (e.g. PG still booting) answers false to its callers but is never
 // reused, so the next runtime checks again.
-export const AUTOMATION_PROBE_TTL_MS = 60_000;
+const AUTOMATION_PROBE_TTL_MS = 60_000;
 
 export function createAutomationProbe(check, { ttlMs = AUTOMATION_PROBE_TTL_MS, now = Date.now } = {}) {
   let pending = null;

package/src/session-runtime/services/channel-session-router.mjs

@@ -1,4 +1,5 @@
 import { channelNotificationModelContent } from '../../runtime/shared/channel-notification-routing.mjs';
+import { PROMPT_ORIGIN_CHANNEL } from '../../runtime/agent/orchestrator/session/manager/pending-message-entry.mjs';
 
 /** The one inbound channel notification method. Exported so every consumer
  *  (daemon router, session runtime) matches the same wire name. */
@@ -21,8 +22,9 @@ export function createChannelSessionRouter({ getSessionService, getSessionId, lo
         prompt: content,
         // A channel notification (webhook event rules carry fenced external
         // values) is queued as a task notification, never as typed input, so
-        // nothing inside it selects a skill.
-        options: { source: 'channel', mode: 'task-notification' },
+        // nothing inside it selects a skill. Its provenance (`origin`) says
+        // it is real external activity, which the mode alone does not.
+        options: { source: 'channel', mode: 'task-notification', origin: PROMPT_ORIGIN_CHANNEL },
       })
     ).catch((error) => {
       log(`channel session delivery failed session=${sessionId}: ${error?.message || error}`);

package/src/session-runtime/services/provider-admin.mjs

@@ -1179,7 +1179,8 @@ export async function saveCustomProvider(cfgMod, rawInput) {
 export async function saveCustomProviderKey(cfgMod, rawId, rawKey) {
   requireLocalProviderManagement();
   const id = String(rawId || '').trim();
-  if (typeof rawKey !== 'string' || rawKey.length > CUSTOM_API_KEY_MAX) throw new TypeError('custom provider apiKey is invalid');
+  if (typeof rawKey !== 'string' || rawKey.length > CUSTOM_API_KEY_MAX)
+    throw new TypeError('custom provider apiKey is invalid');
   const key = rawKey.trim();
   if (!key) throw new Error('API key is required');
   const takesStoredKey = () => {

package/src/session-runtime/services/seeds.mjs

@@ -49,34 +49,6 @@ export function ensureStandaloneEnvironment({ rootDir, dataDir }) {
       /* marker only; the sweep simply repeats */
     }
   }
-  cleanupRetiredChannelSecrets(dataDir);
-}
-
-// One-shot keychain cleanup: Discord/Telegram messaging is retired, so any
-// stored bot tokens are orphans. Marker-gated so the (potentially slow) OS
-// keychain roundtrip runs once per install; lazy import so shared config
-// resolves its paths only after the env above is established.
-function cleanupRetiredChannelSecrets(dataDir) {
-  const marker = join(dataDir, '.retired-channel-secrets-cleaned');
-  if (existsSync(marker)) return;
-  void import('../../runtime/shared/config.mjs')
-    .then(async ({ deleteSecretAsync }) => {
-      for (const account of ['discord.token', 'telegram.token']) {
-        try {
-          await deleteSecretAsync(account);
-        } catch {
-          /* best-effort */
-        }
-      }
-      try {
-        writeFileAtomicSync(marker, `${new Date().toISOString()}\n`);
-      } catch {
-        /* marker only */
-      }
-    })
-    .catch(() => {
-      /* cleanup is best-effort */
-    });
 }
 
 // Shipped definitions live in code (read in place from the package); the data