mixdog 1.4.1 → 1.4.3

package/src/runtime/agent/orchestrator/session/manager/ask-session.mjs

@@ -15,10 +15,12 @@ import { drainPendingMessages, hydratePendingMessages } from './pending-messages
 import { _unlinkParentAbortListener, _getRuntimeEntry, _evictTerminalSessionRuntime } from './runtime-liveness.mjs';
 import { acquireSessionLock } from './session-lock.mjs';
 import { createAskPromptQueue } from './ask-queue.mjs';
-import { armTurnDurability, claimTurnRuntime } from './ask-turn-open.mjs';
+import { armTurnDurability, claimTurnRuntime, settleTurnBase } from './ask-turn-open.mjs';
 import { prepareAskTurn, runAskAgentLoop } from './ask-turn-execute.mjs';
 import { commitAskTurn, publishAskTurn } from './ask-turn-settle.mjs';
+import { carryReportOnError, turnReportText, withEarlierReport } from '../loop/turn-report.mjs';
 import { finalizeAskTurnFailure } from './ask-turn-failure.mjs';
+import { armTurnTimeoutOnProviderError, reapTurnShellJobs } from './turn-reap.mjs';
 import { cacheWarmTurnKind, endCacheWarmTurn, failedTurnProvenance, noteCacheWarmTurn } from '../cache-warm.mjs';
 
 export { _api_call_with_interrupt } from './ask-call-interrupt.mjs';
@@ -77,7 +79,17 @@ export function createAskTranscriptMeta(rawTranscriptMeta) {
 /** One opened turn from provider call to terminal publish; a failure unwinds
  *  the turn state and rethrows. Returns the terminal result preview and the
  *  follow-ups drained right after the provider accepted the turn. */
-async function runAskTurn({ sessionId, opened, input, askOpts, onToolCall, cwdOverride, transcript, askStartedAt }) {
+async function runAskTurn({
+  sessionId,
+  opened,
+  input,
+  askOpts,
+  onToolCall,
+  cwdOverride,
+  transcript,
+  askStartedAt,
+  earlierReport,
+}) {
   let releaseWorkspace;
   try {
     releaseWorkspace = await admitWorkspaceActivity(
@@ -97,6 +109,8 @@ async function runAskTurn({ sessionId, opened, input, askOpts, onToolCall, cwdOv
       // them with what the model was told. Asked again for every user turn
       // the ask runs, queued and background follow-ups included.
       currentAgents: askOpts?.agentsNow?.(),
+      // The session runtime's in-memory settings (the file trails them).
+      agentConfig: askOpts?.agentConfig?.() || null,
     });
     const result = await runAskAgentLoop({
       sessionId,
@@ -107,14 +121,19 @@ async function runAskTurn({ sessionId, opened, input, askOpts, onToolCall, cwdOv
       onToolCall,
       takeAssistantTranscriptMetadata: transcript.takeAssistant,
     });
-    const terminalResultPreview = await commitAskTurn({
-      sessionId,
-      opened,
-      prepared,
-      result,
-      rawTranscriptMeta: transcript.raw,
-      askStartedAt,
-    });
+    // The earlier turns of this ask relayed nothing (publishAskTurn relays
+    // only a turn no queued input follows): their reports lead this one's.
+    const terminalResultPreview = withEarlierReport(
+      await commitAskTurn({
+        sessionId,
+        opened,
+        prepared,
+        result,
+        rawTranscriptMeta: transcript.raw,
+        askStartedAt,
+      }),
+      earlierReport
+    );
     const drained = publishAskTurn({
       sessionId,
       opened,
@@ -125,6 +144,9 @@ async function runAskTurn({ sessionId, opened, input, askOpts, onToolCall, cwdOv
     });
     return { result: terminalResultPreview, drained };
   } catch (err) {
+    // The turn's terminal error: a provider timeout/stall that ended it (a
+    // retry the turn recovered from never reaches here) stops its shell work.
+    armTurnTimeoutOnProviderError(sessionId, opened.runtime, opened.turnSignal, err);
     await finalizeAskTurnFailure({
       sessionId,
       err,
@@ -138,12 +160,50 @@ async function runAskTurn({ sessionId, opened, input, askOpts, onToolCall, cwdOv
       transcriptMeta: transcript.raw,
       askStartedAt,
     });
-    throw err;
+    reapTurnShellJobs(sessionId, opened.runtime);
+    // Queued work that fails still hands on the reports of the turns before it.
+    throw carryReportOnError(err, earlierReport);
   } finally {
-    releaseWorkspace?.();
+    // The result is already published; this only holds the session lock until
+    // the reader lease is removed, so the next turn's admission follows it. A
+    // failed release (the admission thread stopped) never replaces the turn's
+    // own outcome.
+    try {
+      await releaseWorkspace?.();
+    } catch {
+      // Intentionally ignored: see the comment above.
+    }
   }
 }
 
+/** The prompt-cache warmer learns idle gaps from real turns only; a retry is
+ *  classified by the failed turn's stored provenance. The rebuilt retry
+ *  message keeps that provenance (ask-turn-execute.mjs). Returns the warmer's
+ *  turn handle. */
+function noteTurnForCacheWarm(sessionId, claimed, input) {
+  const retryProvenance = failedTurnProvenance(claimed.preSession?.messages, input);
+  if (retryProvenance) input.retryProvenance = retryProvenance;
+  return noteCacheWarmTurn(sessionId, cacheWarmTurnKind(input, claimed.preSession?.messages));
+}
+
+/** Clear the controller only if it's still ours (closeSession may have
+ *  swapped it). The rest of the runtime entry stays intact so agent type=list
+ *  can still surface the final stage (done/error/cancelling). */
+function detachAskRuntime(sessionId, askGeneration) {
+  const entry = _getRuntimeEntry(sessionId);
+  if (entry && entry.generation === askGeneration) {
+    _unlinkParentAbortListener(entry);
+    entry.controller = null;
+    // Detach the live session reference; ask is over.
+    entry.session = null;
+  }
+  // Final-stage runtime diagnostics are useful only while the turn is
+  // unwinding. Once its controller is detached, retaining the full entry
+  // (and any accidental references hanging from it) for the host lifetime
+  // turns one-shot agent traffic into an unbounded manager Map.
+  _evictTerminalSessionRuntime(sessionId);
+}
+
 export async function askSession(sessionId, prompt, context, onToolCall, cwdOverride, explicitPrefetch, askOpts = {}) {
   const askStartedAt = Date.now();
   const transcript = createAskTranscriptMeta(askOpts?.transcriptMeta);
@@ -180,8 +240,9 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
   // Hoisted so the outer finally (which runs once after the whole turn loop)
   // can compare against the last turn's generation.
   let askGeneration = 0;
-  let crashRecoveryChecked = false;
-  let sessionStartEmitted = false;
+  // Crash-checkpoint recovery and the session-start event belong to the first
+  // turn of this ask only.
+  let firstTurn = true;
   // A failed-turn retry rewinds only the turn it retries, never a drained
   // follow-up turn.
   let retryFailedTurn = askOpts.retryFailedTurn === true;
@@ -213,27 +274,32 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
         input.retryAttemptId = askOpts.retryAttemptId;
         retryTurnId = null;
       }
-      // Synchronous pre-await setup (must happen before any await so
-      // closeSession() can't interleave between load and registration).
-      const claimed = claimTurnRuntime({
-        sessionId,
-        askOpts,
-        recoverCheckpoint: !crashRecoveryChecked,
-        emitStart: !sessionStartEmitted,
-      });
-      // The prompt-cache warmer learns idle gaps from real turns only; a
-      // retry is classified by the failed turn's stored provenance.
-      // The rebuilt retry message keeps that provenance (ask-turn-execute.mjs).
-      const retryProvenance = failedTurnProvenance(claimed.preSession?.messages, input);
-      if (retryProvenance) input.retryProvenance = retryProvenance;
-      warmTurn = noteCacheWarmTurn(sessionId, cacheWarmTurnKind(input, claimed.preSession?.messages));
-      crashRecoveryChecked = true;
-      sessionStartEmitted = true;
-      askGeneration = claimed.askGeneration;
-      const opened = {
-        ...claimed,
-        ...armTurnDurability({ sessionId, ...claimed, pendingEntries: input.pendingEntries }),
-      };
+      // The earlier turns of this ask relayed nothing (publishAskTurn relays
+      // only a turn no queued input follows): this turn failing before it
+      // runs (runAskTurn carries the report once it has) still hands them on.
+      const earlierReport = result ? turnReportText(result) : '';
+      let opened;
+      try {
+        // The previous turn's save has landed and this turn's base is on disk
+        // before the turn touches the session (one unsettled turn per session).
+        await settleTurnBase(sessionId, { recoverCheckpoint: firstTurn });
+        // Synchronous pre-await setup (must happen before any await so
+        // closeSession() can't interleave between load and registration).
+        const claimed = claimTurnRuntime({
+          sessionId,
+          askOpts,
+          emitStart: firstTurn,
+        });
+        warmTurn = noteTurnForCacheWarm(sessionId, claimed, input);
+        firstTurn = false;
+        askGeneration = claimed.askGeneration;
+        opened = {
+          ...claimed,
+          ...armTurnDurability({ sessionId, ...claimed, pendingEntries: input.pendingEntries }),
+        };
+      } catch (error) {
+        throw carryReportOnError(error, earlierReport);
+      }
       // From here the turn's own unwind (ask-turn-failure) acks or releases
       // its entries; the queue keeps owning only the not-yet-started ones.
       queue.markStarted();
@@ -246,6 +312,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
         cwdOverride,
         transcript,
         askStartedAt,
+        earlierReport,
       });
       result = turn.result;
       endCacheWarmTurn(sessionId, warmTurn);
@@ -287,21 +354,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
     queue.releaseUnstarted();
     // A thrown setup/provider path must never leave a delayed checkpoint
     // writer alive after the turn lock is released.
-    // Clear the controller only if it's still ours (closeSession may have
-    // swapped it). Leave the rest of the runtime entry intact so agent type=list
-    // can still surface the final stage (done/error/cancelling).
-    const entry = _getRuntimeEntry(sessionId);
-    if (entry && entry.generation === askGeneration) {
-      _unlinkParentAbortListener(entry);
-      entry.controller = null;
-      // Detach the live session reference; ask is over.
-      entry.session = null;
-    }
-    // Final-stage runtime diagnostics are useful only while the turn is
-    // unwinding. Once its controller is detached, retaining the full entry
-    // (and any accidental references hanging from it) for the host lifetime
-    // turns one-shot agent traffic into an unbounded manager Map.
-    _evictTerminalSessionRuntime(sessionId);
+    detachAskRuntime(sessionId, askGeneration);
     unlock();
   }
 }

package/src/runtime/agent/orchestrator/session/manager/ask-turn-auto-effort.mjs

@@ -50,19 +50,21 @@ export function turnStepAutoEffort(autoEffort, effortConfiguration) {
     : null;
 }
 
-export function autoEffortMode() {
+// `config`: a session runtime's in-memory agent config (its file copy trails
+// it by a debounce); other callers read the file.
+export function autoEffortMode(config = null) {
   if (process.env.MIXDOG_AUTO_EFFORT) return normalizeAutoEffortMode(process.env.MIXDOG_AUTO_EFFORT);
   try {
-    return builtinFeatureActive(readSection('agent'), 'autoEffort') ? 'on' : 'off';
+    return builtinFeatureActive(config || readSection('agent'), 'autoEffort') ? 'on' : 'off';
   } catch {
     return 'off';
   }
 }
 
 /** The global "Auto reasoning base" setting; absent or unreadable is medium. */
-export function autoEffortBaseSetting() {
+export function autoEffortBaseSetting(config = null) {
   try {
-    return autoEffortBase(readSection('agent')?.autoEffortBase);
+    return autoEffortBase((config || readSection('agent'))?.autoEffortBase);
   } catch {
     return autoEffortBase(undefined);
   }
@@ -99,8 +101,8 @@ function lastText(messages, role) {
  * briefly (its first-use load is the longest wait): a missing, still-loading,
  * or slow model yields null and the default effort.
  */
-export async function resolveTurnAutoEffort({ sessionId, session, provider, input }) {
-  const mode = autoEffortMode();
+export async function resolveTurnAutoEffort({ sessionId, session, provider, input, config = null }) {
+  const mode = autoEffortMode(config);
   // promptSource marks runtime-injected turns (completion notices, queued work).
   // Agent sessions are judged like any other: their spawn brief and later Lead
   // `send` messages arrive as plain prompts.
@@ -113,7 +115,7 @@ export async function resolveTurnAutoEffort({ sessionId, session, provider, inpu
   if (!turnEffortConfigurationMode(session, provider)) return null;
   const chosen = String(session.effort || '').toLowerCase();
   const options = effortOptionsFor(session.provider, autoEffortModel(session.provider, provider, session.model));
-  const setting = autoEffortBaseSetting();
+  const setting = autoEffortBaseSetting(config);
   const base = clampAutoEffortBase({ base: setting, options }) ?? autoEffortBase(setting);
   const record = {
     at: new Date().toISOString(),

package/src/runtime/agent/orchestrator/session/manager/ask-turn-execute.mjs

@@ -59,7 +59,13 @@ function retainedUserTurn(session, retained, transcriptMeta, currentAgents) {
     },
     currentAgents
   );
-  return { historyMessages, userTurnMessage, outgoing: [...historyMessages, userTurnMessage] };
+  const noticeRevision = retained.message.meta?.promptSettingsNoticeRevision;
+  return {
+    historyMessages,
+    userTurnMessage,
+    outgoing: [...historyMessages, userTurnMessage],
+    promptSettingsNotice: noticeRevision ? { revision: noticeRevision } : null,
+  };
 }
 
 // The turn's user message: the retained one of a retried failed turn, or a
@@ -147,7 +153,15 @@ function persistTurnPreflight(session, { turnToken, startedAt, checkpoint, askGe
 
 /** Resolves the provider, builds the user turn and pre-commits it; returns
  *  what the loop and the commit need from this preparation. */
-export async function prepareAskTurn({ sessionId, opened, input, cwdOverride, transcriptMeta, currentAgents }) {
+export async function prepareAskTurn({
+  sessionId,
+  opened,
+  input,
+  cwdOverride,
+  transcriptMeta,
+  currentAgents,
+  agentConfig = null,
+}) {
   const { turn, runtime, turnSignal, askGeneration, checkpoint, turnToken, startedAt, codexTurnId } = opened;
   const session = turn.session;
   // Where the turn sits in a bot-to-bot chain (session-runtime/bot-hops.mjs).
@@ -167,7 +181,7 @@ export async function prepareAskTurn({ sessionId, opened, input, cwdOverride, tr
   // reads the session as the turn found it (synchronously, on this call).
   // The first request still carries its decision: it is awaited below,
   // together with the user turn, before the effort configuration is stamped.
-  const autoEffortPending = resolveTurnAutoEffort({ sessionId, session, provider, input });
+  const autoEffortPending = resolveTurnAutoEffort({ sessionId, session, provider, input, config: agentConfig });
   autoEffortPending.catch(() => {});
   applyTurnContextMeta(session, provider);
   const effectiveCwd = cwdOverride || session.cwd;
@@ -206,6 +220,9 @@ export async function prepareAskTurn({ sessionId, opened, input, cwdOverride, tr
   if (effortConfiguration) stampTurnEffort(userTurn.userTurnMessage, effortConfiguration);
   const { historyMessages, outgoing } = userTurn;
   turn.userTurnContent = userTurn.userTurnMessage.content;
+  // The turn opens right after the history it was built on: its checkpoint
+  // boundary, never looked up again by the prompt's text.
+  turn.boundary = historyMessages.length;
   turn.outgoing = outgoing;
   precommitUserTurn(session, outgoing, historyMessages, input);
   persistTurnPreflight(session, { turnToken, startedAt, checkpoint, askGeneration });
@@ -236,6 +253,7 @@ export async function prepareAskTurn({ sessionId, opened, input, cwdOverride, tr
     deferredToolDelta: userTurn.deferredToolDelta,
     goalReminder: userTurn.goalReminder,
     workflowNotice: userTurn.workflowNotice,
+    promptSettingsNotice: userTurn.promptSettingsNotice,
     orchestrationModeNotice: userTurn.orchestrationModeNotice,
     workspaceNotice: userTurn.workspaceNotice,
     setupNotice: userTurn.setupNotice,

package/src/runtime/agent/orchestrator/session/manager/ask-turn-failure.mjs

@@ -16,7 +16,7 @@ import {
 } from './pending-messages.mjs';
 import { _getRuntimeEntry, markSessionCancelled, markSessionError } from './runtime-liveness.mjs';
 import { SessionClosedError } from './session-errors.mjs';
-import { clearTurnCheckpoint } from './turn-checkpoint.mjs';
+import { holdTurnUntilDurable, turnCoveredOnDisk } from './turn-durability.mjs';
 import { attachFailedTurnCompletion } from './ask-turn-settle.mjs';
 import { turnFailureRecord } from '../turn-failure.mjs';
 import { transcriptRouteMetadataFields } from '../../../../shared/transcript-metadata.mjs';
@@ -97,6 +97,17 @@ async function persistFinalizedSession({ session, sessionId, generation, pending
   }
 }
 
+/** Keep the failed turn's checkpoint until a landed save covers its
+ *  finalized transcript (turn-durability.mjs); returns the save issued for
+ *  it, or null when an earlier one already landed it. */
+function holdFinalizedTurn({ sessionId, session, turnToken, generation }) {
+  const save = turnCoveredOnDisk(session, turnToken)
+    ? null
+    : saveSessionAsync(session, { expectedGeneration: generation });
+  holdTurnUntilDurable({ sessionId, session, turnToken, generation, save });
+  return save;
+}
+
 /** A SessionClosedError unwind: keeps the interruption snapshot unless the
  *  runtime already closed, in which case the consumed queue entries are
  *  released untouched. */
@@ -119,14 +130,14 @@ async function finalizeCancelledTurn({
   if (currentRuntime?.prepareCloseSnapshot === prepareCloseSnapshot) {
     currentRuntime.prepareCloseSnapshot = null;
   }
-  const settled = await persistFinalizedSession({
+  await persistFinalizedSession({
     session,
     sessionId,
     generation,
     pendingEntries: turn.pendingEntries,
     promptSurvived: finalized.responsePreserved,
   });
-  if (settled) clearTurnCheckpoint(sessionId, turnCheckpointToken);
+  holdFinalizedTurn({ sessionId, session, turnToken: turnCheckpointToken, generation });
   if (currentRuntime) currentRuntime.session = session;
   markSessionCancelled(sessionId);
 }
@@ -169,6 +180,9 @@ export async function finalizeAskTurnFailure({
   if (session) {
     session.liveTurnMessages = null;
     delete session.activeTurnCheckpoint;
+    // Every record saved from here on carries this turn as finalized: a
+    // crash after one lands deletes the checkpoint instead of replaying it.
+    session.turnCoverage = turnCheckpointToken;
     // The provider prefix snapshot commits per successful send INSIDE the
     // turn, while the transcript unwinds to its pre-turn/finalized shape
     // below. A surviving mid-turn snapshot flags every retry as
@@ -206,7 +220,8 @@ export async function finalizeAskTurnFailure({
   // contract answers "did the provider produce output we must commit?" for
   // every transport. Anthropic's stall/truncation errors carry neither
   // liveTextEmitted nor unsafeToRetry — only partialContent/partialToolCalls
-  // — and used to drop the streamed summary from history on that provider.
+  // — so consulting the flags would drop the streamed summary from history on
+  // that provider.
   const providerOutcome = readStreamOutcome(err);
   const preserveProviderPartial =
     restoredResetText ||
@@ -252,15 +267,16 @@ export async function finalizeAskTurnFailure({
       releasePendingMessages(sessionId, turn.pendingEntries);
     }
   }
-  if (!errorStateDurable && session) {
-    try {
-      errorStateDurable = (await settleAskCleanup(saveSessionAsync(session, { expectedGeneration: generation })))
-        .settled;
-    } catch {
-      /* retain checkpoint when canonical persistence fails */
+  if (session) {
+    const save = holdFinalizedTurn({ sessionId, session, turnToken: turnCheckpointToken, generation });
+    if (save && !errorStateDurable) {
+      try {
+        await settleAskCleanup(save);
+      } catch {
+        /* the checkpoint stays until a save covering the turn lands */
+      }
     }
   }
-  if (errorStateDurable) clearTurnCheckpoint(sessionId, turnCheckpointToken);
   logAskError(sessionId, err, providerOutcome);
   markSessionError(sessionId, err?.message ? err.message : String(err));
 }

package/src/runtime/agent/orchestrator/session/manager/ask-turn-open.mjs

@@ -1,25 +1,50 @@
 // manager/ask-turn-open.mjs
-// Opening one turn: load and reconcile the stored session and claim the
+// Opening one turn: settle the previous turn's durability and the durable
+// base this turn opens on (settleTurnBase, awaited before anything below),
+// load and reconcile the stored session and claim the
 // runtime entry with a fresh abort controller (claimTurnRuntime), then arm
 // the turn's durability — the crash-checkpoint scheduler and the close
 // snapshot hook (armTurnDurability). Both are synchronous so closeSession()
 // cannot interleave between load and registration.
 import { randomUUID } from 'node:crypto';
-import { loadSession, saveSession, readSessionLifecycleFromDisk } from '../store.mjs';
+import { loadSession } from '../store.mjs';
+import { durableTranscriptBase } from '../store/transcript-durability.mjs';
 import { createAbortController } from '../../../../shared/abort-controller.mjs';
 import { normalizeStaleCompactingStage } from './compaction-runner.mjs';
 import { linkParentSignalToSession, markSessionAskStart, _touchRuntime } from './runtime-liveness.mjs';
 import { SessionClosedError } from './session-errors.mjs';
 import { ensureCodexWireSessionId, mintUuidV7 } from './session-id.mjs';
 import { createTurnInterruptionTracker } from './turn-interruption.mjs';
-import { clearTurnCheckpoint, recoverTurnCheckpoint } from './turn-checkpoint.mjs';
+import { _recoverTurnCheckpointDurably, setAsideUnrecoveredCheckpoint } from './turn-checkpoint-recovery.mjs';
+import { adoptDiskGeneration, awaitPreviousTurnDurable, ensureDurableTranscript } from './turn-durability.mjs';
 import { emitAskSessionStart } from './ask-support.mjs';
+import { applyHeldSessionRoute } from './session-lifecycle.mjs';
 import { createAskTurnState, createCloseSnapshot, createTurnCheckpointScheduler } from './ask-turn-state.mjs';
 
+/** Before a turn claims the session: the previous turn's finalized
+ *  transcript is durably saved (its checkpoint deleted only then), a crashed
+ *  turn's checkpoint is recovered (`recoverCheckpoint`, once per ask), and
+ *  the transcript the turn opens on is the one a landed save holds — so the
+ *  new checkpoint names a base that is on disk. Throws TurnPersistenceError
+ *  when a save does not land; other sessions never wait on this one. */
+export async function settleTurnBase(sessionId, { recoverCheckpoint }) {
+  await awaitPreviousTurnDurable(sessionId);
+  const session = loadSession(sessionId);
+  // claimTurnRuntime reports a missing or closed session.
+  if (!session || session.closed === true) return;
+  adoptDiskGeneration(session, sessionId);
+  if (recoverCheckpoint) _recoverTurnCheckpointDurably(session, sessionId);
+  await ensureDurableTranscript(session);
+  // This turn's checkpoint replaces the session's checkpoint file. Whatever
+  // is still there (a conflict, an unreadable header, a crashed turn this
+  // ask did not recover) is set aside first, never overwritten.
+  setAsideUnrecoveredCheckpoint(session, sessionId);
+}
+
 /** Loads the session for a new turn and reconciles its on-disk lifecycle:
- *  crash-checkpoint recovery (once per ask), a stale compacting stage, and
- *  split-brain re-adoption of a disk generation another surface bumped. */
-function loadTurnSession(sessionId, { recoverCheckpoint }) {
+ *  a stale compacting stage and split-brain re-adoption of a disk generation
+ *  another surface bumped. */
+function loadTurnSession(sessionId) {
   const session = loadSession(sessionId);
   if (!session) {
     throw new Error(`Session "${sessionId}" not found`);
@@ -28,44 +53,21 @@ function loadTurnSession(sessionId, { recoverCheckpoint }) {
     throw new SessionClosedError(sessionId, 'session already closed');
   }
   const codexWireSessionId = ensureCodexWireSessionId(session);
-  if (recoverCheckpoint) {
-    const recovery = recoverTurnCheckpoint(session);
-    if (recovery.changed) {
-      saveSession(session, {
-        sync: true,
-        expectedGeneration: session.generation,
-      });
-      if (recovery.turnToken) clearTurnCheckpoint(sessionId, recovery.turnToken);
-    }
-  }
   // A prior crash/partial-save during compaction may have pinned
   // compaction.lastStage='compacting'. This ask is starting fresh, so
   // recover the stale transient stage before the loop's pre-send compact
   // path runs (it will overwrite lastStage with real telemetry).
   normalizeStaleCompactingStage(session);
-  // Split-brain re-adoption: another surface (e.g. desktop click-through
-  // of a session still actively owned by this process) may have
-  // resumed-and-detached this session, bumping the ON-DISK generation
-  // while the conversation kept going here. Every save from this process
-  // would then be silently dropped by _shouldDrop's ownership rule and
-  // the on-disk transcript would freeze at the last landed save. A new
-  // ask on a NON-closed session is an explicit ownership claim: adopt
-  // the disk generation so this turn's commits land and heal the file.
-  const diskLifecycle = readSessionLifecycleFromDisk(sessionId);
-  if (
-    diskLifecycle &&
-    diskLifecycle.closed !== true &&
-    diskLifecycle.generation > (typeof session.generation === 'number' ? session.generation : 0)
-  ) {
-    session.generation = diskLifecycle.generation;
-  }
+  adoptDiskGeneration(session, sessionId);
+  // A route saved while the previous turn ran applies from this turn.
+  applyHeldSessionRoute(session);
   return { session, codexWireSessionId };
 }
 
 /** Loads the session and installs this turn's controller on the runtime
  *  entry, re-cascading any parent abort link and marking the ask started. */
-export function claimTurnRuntime({ sessionId, askOpts, recoverCheckpoint, emitStart }) {
-  const { session: preSession, codexWireSessionId } = loadTurnSession(sessionId, { recoverCheckpoint });
+export function claimTurnRuntime({ sessionId, askOpts, emitStart }) {
+  const { session: preSession, codexWireSessionId } = loadTurnSession(sessionId);
   const askGeneration = typeof preSession.generation === 'number' ? preSession.generation : 0;
   const runtime = _touchRuntime(sessionId);
   // Preserve any parent-abort link agent-dispatch established BEFORE we
@@ -121,6 +123,7 @@ export function armTurnDurability({
     startedAt,
     turn,
     interruption,
+    base: durableTranscriptBase(preSession),
   });
   const prepareCloseSnapshot = createCloseSnapshot({ turn, interruption, checkpoint, runtime });
   // closeSession is synchronous and generation-first by design. Expose a

package/src/runtime/agent/orchestrator/session/manager/ask-turn-prepare.mjs

@@ -9,6 +9,7 @@ import { positiveInt } from '../../../../shared/numbers.mjs';
 import { appendAgentTrace } from '../../agent-trace.mjs';
 import { snapshotPendingDeferredToolDelta } from '../../runtime-core/deferred-tool-delta.mjs';
 import { snapshotPendingGoalReminder } from '../../runtime-core/goal-reminder.mjs';
+import { beginTodoTurn, todoStartReminder } from '../loop/no-tool-turn/todo-check.mjs';
 import { resolveSessionContextMeta } from './context-meta.mjs';
 import {
   promptContentText,
@@ -20,6 +21,7 @@ import {
   snapshotPendingSetupNotice,
 } from './prompt-utils.mjs';
 import { snapshotPendingWorkflowNotice } from './workflow-switch-notice.mjs';
+import { snapshotPendingPromptSettingsNotice } from './prompt-settings.mjs';
 import { snapshotPendingOrchestrationModeNotice } from './orchestration-mode-switch-notice.mjs';
 import { buildAgentListingNotice } from './agent-listing-notice.mjs';
 import { codexWireSendOpts } from './session-id.mjs';
@@ -175,6 +177,12 @@ export async function buildUserTurn({
   }
   const currentTimeBlock = buildCurrentTimeBlock(prompt);
   const deferredToolDelta = snapshotPendingDeferredToolDelta(session);
+  // A real prompt (no runtime source: not a Goal turn or task notification)
+  // opens a new todo reminder cycle; every turn clears the last turn's waits.
+  const genuinePrompt = !turnPromptSource?.source;
+  beginTodoTurn(session, { genuine: genuinePrompt });
+  // An agent's new brief or follow-up with no open list asks for one, once.
+  const todoStart = genuinePrompt ? todoStartReminder(session) : null;
   // Read paused state after hydration and queue selection, not at
   // input intake: either can precede the previous turn's pause.
   // This supplies context only; it never resumes the Goal.
@@ -192,8 +200,11 @@ export async function buildUserTurn({
   const orchestrationModeNotice = snapshotPendingOrchestrationModeNotice(session);
   // Agents enabled or switched off since the conversation was last told.
   const agentListingNotice = buildAgentListingNotice(session, currentAgents);
+  // Prompt-shaping settings changed since the prompt was built (told once).
+  const promptSettingsNotice = snapshotPendingPromptSettingsNotice(session);
   const reminderBlock = [
     workflowNotice?.content || '',
+    promptSettingsNotice?.content || '',
     orchestrationModeNotice?.content || '',
     agentListingNotice?.content || '',
     workspaceNotice?.content || '',
@@ -201,6 +212,7 @@ export async function buildUserTurn({
     currentTimeBlock ? `<system-reminder>\n# Current Time\n${currentTimeBlock}\n</system-reminder>` : '',
     deferredToolDelta?.content || '',
     goalReminder?.content || '',
+    todoStart || '',
   ]
     .filter(Boolean)
     .join('\n\n');
@@ -212,6 +224,8 @@ export async function buildUserTurn({
     ...(effortConfiguration ? { effortConfiguration } : {}),
     // What its reminder told, read back by later turns (agent-listing-notice.mjs).
     ...(agentListingNotice ? { agentListing: agentListingNotice.meta } : {}),
+    // A retry resubmits this message as is: it acknowledges the same notice.
+    ...(promptSettingsNotice ? { promptSettingsNoticeRevision: promptSettingsNotice.revision } : {}),
   };
   const userTurnMessage = withRuntimeUserContext(
     {
@@ -228,6 +242,7 @@ export async function buildUserTurn({
     goalReminder,
     workflowNotice,
     orchestrationModeNotice,
+    promptSettingsNotice,
     agentListingNotice,
     workspaceNotice,
     setupNotice,