mixdog 1.4.2 → 1.4.3

package/src/runtime/agent/orchestrator/session/loop/turn-report.mjs

@@ -0,0 +1,35 @@
+// The report a finished ask hands its caller (an agent's owner).
+//
+// A turn's `content` is what the live view still needs at its end: the text
+// since the last tool batch. An answer the turn kept going past (a todo
+// reminder or queued input arrived after it) and a turn that queued input
+// followed in the same ask are both older than that, so the result carries
+// them in `reportContent`, ahead of the newest text.
+
+export function joinReports(parts) {
+  return parts
+    .map((part) => String(part || '').trim())
+    .filter(Boolean)
+    .join('\n\n');
+}
+
+/** The whole report of a result: `reportContent` when the ask carried earlier
+ *  answers, else its content. */
+export function turnReportText(result) {
+  if (typeof result?.reportContent === 'string') return result.reportContent;
+  return typeof result?.content === 'string' ? result.content : '';
+}
+
+/** `result` with `earlier` answers ahead of its own report. */
+export function withEarlierReport(result, earlier) {
+  if (!earlier) return result;
+  return { ...result, reportContent: joinReports([earlier, turnReportText(result)]) };
+}
+
+/** A turn that fails after such answers still hands them on: `error` carries
+ *  them (`carriedReport`, earliest first) to whoever reports the failure. */
+export function carryReportOnError(error, earlier) {
+  if (!earlier || !error || typeof error !== 'object') return error;
+  error.carriedReport = joinReports([earlier, typeof error.carriedReport === 'string' ? error.carriedReport : '']);
+  return error;
+}

package/src/runtime/agent/orchestrator/session/loop/usage.mjs

@@ -90,7 +90,7 @@ const SUMMED_USAGE_FIELDS = [
 ];
 
 /** What `total` added after the running total `earlier` (both from addUsage); null when nothing. */
-export function usageSince(total, earlier) {
+function usageSince(total, earlier) {
   if (!total) return null;
   if (!earlier) return { ...total };
   const delta = {};

package/src/runtime/agent/orchestrator/session/manager/ask-session.mjs

@@ -15,9 +15,10 @@ import { drainPendingMessages, hydratePendingMessages } from './pending-messages
 import { _unlinkParentAbortListener, _getRuntimeEntry, _evictTerminalSessionRuntime } from './runtime-liveness.mjs';
 import { acquireSessionLock } from './session-lock.mjs';
 import { createAskPromptQueue } from './ask-queue.mjs';
-import { armTurnDurability, claimTurnRuntime } from './ask-turn-open.mjs';
+import { armTurnDurability, claimTurnRuntime, settleTurnBase } from './ask-turn-open.mjs';
 import { prepareAskTurn, runAskAgentLoop } from './ask-turn-execute.mjs';
 import { commitAskTurn, publishAskTurn } from './ask-turn-settle.mjs';
+import { carryReportOnError, turnReportText, withEarlierReport } from '../loop/turn-report.mjs';
 import { finalizeAskTurnFailure } from './ask-turn-failure.mjs';
 import { armTurnTimeoutOnProviderError, reapTurnShellJobs } from './turn-reap.mjs';
 import { cacheWarmTurnKind, endCacheWarmTurn, failedTurnProvenance, noteCacheWarmTurn } from '../cache-warm.mjs';
@@ -78,7 +79,17 @@ export function createAskTranscriptMeta(rawTranscriptMeta) {
 /** One opened turn from provider call to terminal publish; a failure unwinds
  *  the turn state and rethrows. Returns the terminal result preview and the
  *  follow-ups drained right after the provider accepted the turn. */
-async function runAskTurn({ sessionId, opened, input, askOpts, onToolCall, cwdOverride, transcript, askStartedAt }) {
+async function runAskTurn({
+  sessionId,
+  opened,
+  input,
+  askOpts,
+  onToolCall,
+  cwdOverride,
+  transcript,
+  askStartedAt,
+  earlierReport,
+}) {
   let releaseWorkspace;
   try {
     releaseWorkspace = await admitWorkspaceActivity(
@@ -98,6 +109,8 @@ async function runAskTurn({ sessionId, opened, input, askOpts, onToolCall, cwdOv
       // them with what the model was told. Asked again for every user turn
       // the ask runs, queued and background follow-ups included.
       currentAgents: askOpts?.agentsNow?.(),
+      // The session runtime's in-memory settings (the file trails them).
+      agentConfig: askOpts?.agentConfig?.() || null,
     });
     const result = await runAskAgentLoop({
       sessionId,
@@ -108,14 +121,19 @@ async function runAskTurn({ sessionId, opened, input, askOpts, onToolCall, cwdOv
       onToolCall,
       takeAssistantTranscriptMetadata: transcript.takeAssistant,
     });
-    const terminalResultPreview = await commitAskTurn({
-      sessionId,
-      opened,
-      prepared,
-      result,
-      rawTranscriptMeta: transcript.raw,
-      askStartedAt,
-    });
+    // The earlier turns of this ask relayed nothing (publishAskTurn relays
+    // only a turn no queued input follows): their reports lead this one's.
+    const terminalResultPreview = withEarlierReport(
+      await commitAskTurn({
+        sessionId,
+        opened,
+        prepared,
+        result,
+        rawTranscriptMeta: transcript.raw,
+        askStartedAt,
+      }),
+      earlierReport
+    );
     const drained = publishAskTurn({
       sessionId,
       opened,
@@ -143,7 +161,8 @@ async function runAskTurn({ sessionId, opened, input, askOpts, onToolCall, cwdOv
       askStartedAt,
     });
     reapTurnShellJobs(sessionId, opened.runtime);
-    throw err;
+    // Queued work that fails still hands on the reports of the turns before it.
+    throw carryReportOnError(err, earlierReport);
   } finally {
     // The result is already published; this only holds the session lock until
     // the reader lease is removed, so the next turn's admission follows it. A
@@ -255,21 +274,32 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
         input.retryAttemptId = askOpts.retryAttemptId;
         retryTurnId = null;
       }
-      // Synchronous pre-await setup (must happen before any await so
-      // closeSession() can't interleave between load and registration).
-      const claimed = claimTurnRuntime({
-        sessionId,
-        askOpts,
-        recoverCheckpoint: firstTurn,
-        emitStart: firstTurn,
-      });
-      warmTurn = noteTurnForCacheWarm(sessionId, claimed, input);
-      firstTurn = false;
-      askGeneration = claimed.askGeneration;
-      const opened = {
-        ...claimed,
-        ...armTurnDurability({ sessionId, ...claimed, pendingEntries: input.pendingEntries }),
-      };
+      // The earlier turns of this ask relayed nothing (publishAskTurn relays
+      // only a turn no queued input follows): this turn failing before it
+      // runs (runAskTurn carries the report once it has) still hands them on.
+      const earlierReport = result ? turnReportText(result) : '';
+      let opened;
+      try {
+        // The previous turn's save has landed and this turn's base is on disk
+        // before the turn touches the session (one unsettled turn per session).
+        await settleTurnBase(sessionId, { recoverCheckpoint: firstTurn });
+        // Synchronous pre-await setup (must happen before any await so
+        // closeSession() can't interleave between load and registration).
+        const claimed = claimTurnRuntime({
+          sessionId,
+          askOpts,
+          emitStart: firstTurn,
+        });
+        warmTurn = noteTurnForCacheWarm(sessionId, claimed, input);
+        firstTurn = false;
+        askGeneration = claimed.askGeneration;
+        opened = {
+          ...claimed,
+          ...armTurnDurability({ sessionId, ...claimed, pendingEntries: input.pendingEntries }),
+        };
+      } catch (error) {
+        throw carryReportOnError(error, earlierReport);
+      }
       // From here the turn's own unwind (ask-turn-failure) acks or releases
       // its entries; the queue keeps owning only the not-yet-started ones.
       queue.markStarted();
@@ -282,6 +312,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
         cwdOverride,
         transcript,
         askStartedAt,
+        earlierReport,
       });
       result = turn.result;
       endCacheWarmTurn(sessionId, warmTurn);

package/src/runtime/agent/orchestrator/session/manager/ask-turn-auto-effort.mjs

@@ -50,19 +50,21 @@ export function turnStepAutoEffort(autoEffort, effortConfiguration) {
     : null;
 }
 
-export function autoEffortMode() {
+// `config`: a session runtime's in-memory agent config (its file copy trails
+// it by a debounce); other callers read the file.
+export function autoEffortMode(config = null) {
   if (process.env.MIXDOG_AUTO_EFFORT) return normalizeAutoEffortMode(process.env.MIXDOG_AUTO_EFFORT);
   try {
-    return builtinFeatureActive(readSection('agent'), 'autoEffort') ? 'on' : 'off';
+    return builtinFeatureActive(config || readSection('agent'), 'autoEffort') ? 'on' : 'off';
   } catch {
     return 'off';
   }
 }
 
 /** The global "Auto reasoning base" setting; absent or unreadable is medium. */
-export function autoEffortBaseSetting() {
+export function autoEffortBaseSetting(config = null) {
   try {
-    return autoEffortBase(readSection('agent')?.autoEffortBase);
+    return autoEffortBase((config || readSection('agent'))?.autoEffortBase);
   } catch {
     return autoEffortBase(undefined);
   }
@@ -99,8 +101,8 @@ function lastText(messages, role) {
  * briefly (its first-use load is the longest wait): a missing, still-loading,
  * or slow model yields null and the default effort.
  */
-export async function resolveTurnAutoEffort({ sessionId, session, provider, input }) {
-  const mode = autoEffortMode();
+export async function resolveTurnAutoEffort({ sessionId, session, provider, input, config = null }) {
+  const mode = autoEffortMode(config);
   // promptSource marks runtime-injected turns (completion notices, queued work).
   // Agent sessions are judged like any other: their spawn brief and later Lead
   // `send` messages arrive as plain prompts.
@@ -113,7 +115,7 @@ export async function resolveTurnAutoEffort({ sessionId, session, provider, inpu
   if (!turnEffortConfigurationMode(session, provider)) return null;
   const chosen = String(session.effort || '').toLowerCase();
   const options = effortOptionsFor(session.provider, autoEffortModel(session.provider, provider, session.model));
-  const setting = autoEffortBaseSetting();
+  const setting = autoEffortBaseSetting(config);
   const base = clampAutoEffortBase({ base: setting, options }) ?? autoEffortBase(setting);
   const record = {
     at: new Date().toISOString(),

package/src/runtime/agent/orchestrator/session/manager/ask-turn-execute.mjs

@@ -59,7 +59,13 @@ function retainedUserTurn(session, retained, transcriptMeta, currentAgents) {
     },
     currentAgents
   );
-  return { historyMessages, userTurnMessage, outgoing: [...historyMessages, userTurnMessage] };
+  const noticeRevision = retained.message.meta?.promptSettingsNoticeRevision;
+  return {
+    historyMessages,
+    userTurnMessage,
+    outgoing: [...historyMessages, userTurnMessage],
+    promptSettingsNotice: noticeRevision ? { revision: noticeRevision } : null,
+  };
 }
 
 // The turn's user message: the retained one of a retried failed turn, or a
@@ -147,7 +153,15 @@ function persistTurnPreflight(session, { turnToken, startedAt, checkpoint, askGe
 
 /** Resolves the provider, builds the user turn and pre-commits it; returns
  *  what the loop and the commit need from this preparation. */
-export async function prepareAskTurn({ sessionId, opened, input, cwdOverride, transcriptMeta, currentAgents }) {
+export async function prepareAskTurn({
+  sessionId,
+  opened,
+  input,
+  cwdOverride,
+  transcriptMeta,
+  currentAgents,
+  agentConfig = null,
+}) {
   const { turn, runtime, turnSignal, askGeneration, checkpoint, turnToken, startedAt, codexTurnId } = opened;
   const session = turn.session;
   // Where the turn sits in a bot-to-bot chain (session-runtime/bot-hops.mjs).
@@ -167,7 +181,7 @@ export async function prepareAskTurn({ sessionId, opened, input, cwdOverride, tr
   // reads the session as the turn found it (synchronously, on this call).
   // The first request still carries its decision: it is awaited below,
   // together with the user turn, before the effort configuration is stamped.
-  const autoEffortPending = resolveTurnAutoEffort({ sessionId, session, provider, input });
+  const autoEffortPending = resolveTurnAutoEffort({ sessionId, session, provider, input, config: agentConfig });
   autoEffortPending.catch(() => {});
   applyTurnContextMeta(session, provider);
   const effectiveCwd = cwdOverride || session.cwd;
@@ -206,6 +220,9 @@ export async function prepareAskTurn({ sessionId, opened, input, cwdOverride, tr
   if (effortConfiguration) stampTurnEffort(userTurn.userTurnMessage, effortConfiguration);
   const { historyMessages, outgoing } = userTurn;
   turn.userTurnContent = userTurn.userTurnMessage.content;
+  // The turn opens right after the history it was built on: its checkpoint
+  // boundary, never looked up again by the prompt's text.
+  turn.boundary = historyMessages.length;
   turn.outgoing = outgoing;
   precommitUserTurn(session, outgoing, historyMessages, input);
   persistTurnPreflight(session, { turnToken, startedAt, checkpoint, askGeneration });
@@ -236,6 +253,7 @@ export async function prepareAskTurn({ sessionId, opened, input, cwdOverride, tr
     deferredToolDelta: userTurn.deferredToolDelta,
     goalReminder: userTurn.goalReminder,
     workflowNotice: userTurn.workflowNotice,
+    promptSettingsNotice: userTurn.promptSettingsNotice,
     orchestrationModeNotice: userTurn.orchestrationModeNotice,
     workspaceNotice: userTurn.workspaceNotice,
     setupNotice: userTurn.setupNotice,

package/src/runtime/agent/orchestrator/session/manager/ask-turn-failure.mjs

@@ -16,7 +16,7 @@ import {
 } from './pending-messages.mjs';
 import { _getRuntimeEntry, markSessionCancelled, markSessionError } from './runtime-liveness.mjs';
 import { SessionClosedError } from './session-errors.mjs';
-import { clearTurnCheckpoint } from './turn-checkpoint.mjs';
+import { holdTurnUntilDurable, turnCoveredOnDisk } from './turn-durability.mjs';
 import { attachFailedTurnCompletion } from './ask-turn-settle.mjs';
 import { turnFailureRecord } from '../turn-failure.mjs';
 import { transcriptRouteMetadataFields } from '../../../../shared/transcript-metadata.mjs';
@@ -97,6 +97,17 @@ async function persistFinalizedSession({ session, sessionId, generation, pending
   }
 }
 
+/** Keep the failed turn's checkpoint until a landed save covers its
+ *  finalized transcript (turn-durability.mjs); returns the save issued for
+ *  it, or null when an earlier one already landed it. */
+function holdFinalizedTurn({ sessionId, session, turnToken, generation }) {
+  const save = turnCoveredOnDisk(session, turnToken)
+    ? null
+    : saveSessionAsync(session, { expectedGeneration: generation });
+  holdTurnUntilDurable({ sessionId, session, turnToken, generation, save });
+  return save;
+}
+
 /** A SessionClosedError unwind: keeps the interruption snapshot unless the
  *  runtime already closed, in which case the consumed queue entries are
  *  released untouched. */
@@ -119,14 +130,14 @@ async function finalizeCancelledTurn({
   if (currentRuntime?.prepareCloseSnapshot === prepareCloseSnapshot) {
     currentRuntime.prepareCloseSnapshot = null;
   }
-  const settled = await persistFinalizedSession({
+  await persistFinalizedSession({
     session,
     sessionId,
     generation,
     pendingEntries: turn.pendingEntries,
     promptSurvived: finalized.responsePreserved,
   });
-  if (settled) clearTurnCheckpoint(sessionId, turnCheckpointToken);
+  holdFinalizedTurn({ sessionId, session, turnToken: turnCheckpointToken, generation });
   if (currentRuntime) currentRuntime.session = session;
   markSessionCancelled(sessionId);
 }
@@ -169,6 +180,9 @@ export async function finalizeAskTurnFailure({
   if (session) {
     session.liveTurnMessages = null;
     delete session.activeTurnCheckpoint;
+    // Every record saved from here on carries this turn as finalized: a
+    // crash after one lands deletes the checkpoint instead of replaying it.
+    session.turnCoverage = turnCheckpointToken;
     // The provider prefix snapshot commits per successful send INSIDE the
     // turn, while the transcript unwinds to its pre-turn/finalized shape
     // below. A surviving mid-turn snapshot flags every retry as
@@ -206,7 +220,8 @@ export async function finalizeAskTurnFailure({
   // contract answers "did the provider produce output we must commit?" for
   // every transport. Anthropic's stall/truncation errors carry neither
   // liveTextEmitted nor unsafeToRetry — only partialContent/partialToolCalls
-  // — and used to drop the streamed summary from history on that provider.
+  // — so consulting the flags would drop the streamed summary from history on
+  // that provider.
   const providerOutcome = readStreamOutcome(err);
   const preserveProviderPartial =
     restoredResetText ||
@@ -252,15 +267,16 @@ export async function finalizeAskTurnFailure({
       releasePendingMessages(sessionId, turn.pendingEntries);
     }
   }
-  if (!errorStateDurable && session) {
-    try {
-      errorStateDurable = (await settleAskCleanup(saveSessionAsync(session, { expectedGeneration: generation })))
-        .settled;
-    } catch {
-      /* retain checkpoint when canonical persistence fails */
+  if (session) {
+    const save = holdFinalizedTurn({ sessionId, session, turnToken: turnCheckpointToken, generation });
+    if (save && !errorStateDurable) {
+      try {
+        await settleAskCleanup(save);
+      } catch {
+        /* the checkpoint stays until a save covering the turn lands */
+      }
     }
   }
-  if (errorStateDurable) clearTurnCheckpoint(sessionId, turnCheckpointToken);
   logAskError(sessionId, err, providerOutcome);
   markSessionError(sessionId, err?.message ? err.message : String(err));
 }

package/src/runtime/agent/orchestrator/session/manager/ask-turn-open.mjs

@@ -1,25 +1,50 @@
 // manager/ask-turn-open.mjs
-// Opening one turn: load and reconcile the stored session and claim the
+// Opening one turn: settle the previous turn's durability and the durable
+// base this turn opens on (settleTurnBase, awaited before anything below),
+// load and reconcile the stored session and claim the
 // runtime entry with a fresh abort controller (claimTurnRuntime), then arm
 // the turn's durability — the crash-checkpoint scheduler and the close
 // snapshot hook (armTurnDurability). Both are synchronous so closeSession()
 // cannot interleave between load and registration.
 import { randomUUID } from 'node:crypto';
-import { loadSession, saveSession, readSessionLifecycleFromDisk } from '../store.mjs';
+import { loadSession } from '../store.mjs';
+import { durableTranscriptBase } from '../store/transcript-durability.mjs';
 import { createAbortController } from '../../../../shared/abort-controller.mjs';
 import { normalizeStaleCompactingStage } from './compaction-runner.mjs';
 import { linkParentSignalToSession, markSessionAskStart, _touchRuntime } from './runtime-liveness.mjs';
 import { SessionClosedError } from './session-errors.mjs';
 import { ensureCodexWireSessionId, mintUuidV7 } from './session-id.mjs';
 import { createTurnInterruptionTracker } from './turn-interruption.mjs';
-import { clearTurnCheckpoint, recoverTurnCheckpoint } from './turn-checkpoint.mjs';
+import { _recoverTurnCheckpointDurably, setAsideUnrecoveredCheckpoint } from './turn-checkpoint-recovery.mjs';
+import { adoptDiskGeneration, awaitPreviousTurnDurable, ensureDurableTranscript } from './turn-durability.mjs';
 import { emitAskSessionStart } from './ask-support.mjs';
+import { applyHeldSessionRoute } from './session-lifecycle.mjs';
 import { createAskTurnState, createCloseSnapshot, createTurnCheckpointScheduler } from './ask-turn-state.mjs';
 
+/** Before a turn claims the session: the previous turn's finalized
+ *  transcript is durably saved (its checkpoint deleted only then), a crashed
+ *  turn's checkpoint is recovered (`recoverCheckpoint`, once per ask), and
+ *  the transcript the turn opens on is the one a landed save holds — so the
+ *  new checkpoint names a base that is on disk. Throws TurnPersistenceError
+ *  when a save does not land; other sessions never wait on this one. */
+export async function settleTurnBase(sessionId, { recoverCheckpoint }) {
+  await awaitPreviousTurnDurable(sessionId);
+  const session = loadSession(sessionId);
+  // claimTurnRuntime reports a missing or closed session.
+  if (!session || session.closed === true) return;
+  adoptDiskGeneration(session, sessionId);
+  if (recoverCheckpoint) _recoverTurnCheckpointDurably(session, sessionId);
+  await ensureDurableTranscript(session);
+  // This turn's checkpoint replaces the session's checkpoint file. Whatever
+  // is still there (a conflict, an unreadable header, a crashed turn this
+  // ask did not recover) is set aside first, never overwritten.
+  setAsideUnrecoveredCheckpoint(session, sessionId);
+}
+
 /** Loads the session for a new turn and reconciles its on-disk lifecycle:
- *  crash-checkpoint recovery (once per ask), a stale compacting stage, and
- *  split-brain re-adoption of a disk generation another surface bumped. */
-function loadTurnSession(sessionId, { recoverCheckpoint }) {
+ *  a stale compacting stage and split-brain re-adoption of a disk generation
+ *  another surface bumped. */
+function loadTurnSession(sessionId) {
   const session = loadSession(sessionId);
   if (!session) {
     throw new Error(`Session "${sessionId}" not found`);
@@ -28,44 +53,21 @@ function loadTurnSession(sessionId, { recoverCheckpoint }) {
     throw new SessionClosedError(sessionId, 'session already closed');
   }
   const codexWireSessionId = ensureCodexWireSessionId(session);
-  if (recoverCheckpoint) {
-    const recovery = recoverTurnCheckpoint(session);
-    if (recovery.changed) {
-      saveSession(session, {
-        sync: true,
-        expectedGeneration: session.generation,
-      });
-      if (recovery.turnToken) clearTurnCheckpoint(sessionId, recovery.turnToken);
-    }
-  }
   // A prior crash/partial-save during compaction may have pinned
   // compaction.lastStage='compacting'. This ask is starting fresh, so
   // recover the stale transient stage before the loop's pre-send compact
   // path runs (it will overwrite lastStage with real telemetry).
   normalizeStaleCompactingStage(session);
-  // Split-brain re-adoption: another surface (e.g. desktop click-through
-  // of a session still actively owned by this process) may have
-  // resumed-and-detached this session, bumping the ON-DISK generation
-  // while the conversation kept going here. Every save from this process
-  // would then be silently dropped by _shouldDrop's ownership rule and
-  // the on-disk transcript would freeze at the last landed save. A new
-  // ask on a NON-closed session is an explicit ownership claim: adopt
-  // the disk generation so this turn's commits land and heal the file.
-  const diskLifecycle = readSessionLifecycleFromDisk(sessionId);
-  if (
-    diskLifecycle &&
-    diskLifecycle.closed !== true &&
-    diskLifecycle.generation > (typeof session.generation === 'number' ? session.generation : 0)
-  ) {
-    session.generation = diskLifecycle.generation;
-  }
+  adoptDiskGeneration(session, sessionId);
+  // A route saved while the previous turn ran applies from this turn.
+  applyHeldSessionRoute(session);
   return { session, codexWireSessionId };
 }
 
 /** Loads the session and installs this turn's controller on the runtime
  *  entry, re-cascading any parent abort link and marking the ask started. */
-export function claimTurnRuntime({ sessionId, askOpts, recoverCheckpoint, emitStart }) {
-  const { session: preSession, codexWireSessionId } = loadTurnSession(sessionId, { recoverCheckpoint });
+export function claimTurnRuntime({ sessionId, askOpts, emitStart }) {
+  const { session: preSession, codexWireSessionId } = loadTurnSession(sessionId);
   const askGeneration = typeof preSession.generation === 'number' ? preSession.generation : 0;
   const runtime = _touchRuntime(sessionId);
   // Preserve any parent-abort link agent-dispatch established BEFORE we
@@ -121,6 +123,7 @@ export function armTurnDurability({
     startedAt,
     turn,
     interruption,
+    base: durableTranscriptBase(preSession),
   });
   const prepareCloseSnapshot = createCloseSnapshot({ turn, interruption, checkpoint, runtime });
   // closeSession is synchronous and generation-first by design. Expose a

package/src/runtime/agent/orchestrator/session/manager/ask-turn-prepare.mjs

@@ -9,6 +9,7 @@ import { positiveInt } from '../../../../shared/numbers.mjs';
 import { appendAgentTrace } from '../../agent-trace.mjs';
 import { snapshotPendingDeferredToolDelta } from '../../runtime-core/deferred-tool-delta.mjs';
 import { snapshotPendingGoalReminder } from '../../runtime-core/goal-reminder.mjs';
+import { beginTodoTurn, todoStartReminder } from '../loop/no-tool-turn/todo-check.mjs';
 import { resolveSessionContextMeta } from './context-meta.mjs';
 import {
   promptContentText,
@@ -20,6 +21,7 @@ import {
   snapshotPendingSetupNotice,
 } from './prompt-utils.mjs';
 import { snapshotPendingWorkflowNotice } from './workflow-switch-notice.mjs';
+import { snapshotPendingPromptSettingsNotice } from './prompt-settings.mjs';
 import { snapshotPendingOrchestrationModeNotice } from './orchestration-mode-switch-notice.mjs';
 import { buildAgentListingNotice } from './agent-listing-notice.mjs';
 import { codexWireSendOpts } from './session-id.mjs';
@@ -175,6 +177,12 @@ export async function buildUserTurn({
   }
   const currentTimeBlock = buildCurrentTimeBlock(prompt);
   const deferredToolDelta = snapshotPendingDeferredToolDelta(session);
+  // A real prompt (no runtime source: not a Goal turn or task notification)
+  // opens a new todo reminder cycle; every turn clears the last turn's waits.
+  const genuinePrompt = !turnPromptSource?.source;
+  beginTodoTurn(session, { genuine: genuinePrompt });
+  // An agent's new brief or follow-up with no open list asks for one, once.
+  const todoStart = genuinePrompt ? todoStartReminder(session) : null;
   // Read paused state after hydration and queue selection, not at
   // input intake: either can precede the previous turn's pause.
   // This supplies context only; it never resumes the Goal.
@@ -192,8 +200,11 @@ export async function buildUserTurn({
   const orchestrationModeNotice = snapshotPendingOrchestrationModeNotice(session);
   // Agents enabled or switched off since the conversation was last told.
   const agentListingNotice = buildAgentListingNotice(session, currentAgents);
+  // Prompt-shaping settings changed since the prompt was built (told once).
+  const promptSettingsNotice = snapshotPendingPromptSettingsNotice(session);
   const reminderBlock = [
     workflowNotice?.content || '',
+    promptSettingsNotice?.content || '',
     orchestrationModeNotice?.content || '',
     agentListingNotice?.content || '',
     workspaceNotice?.content || '',
@@ -201,6 +212,7 @@ export async function buildUserTurn({
     currentTimeBlock ? `<system-reminder>\n# Current Time\n${currentTimeBlock}\n</system-reminder>` : '',
     deferredToolDelta?.content || '',
     goalReminder?.content || '',
+    todoStart || '',
   ]
     .filter(Boolean)
     .join('\n\n');
@@ -212,6 +224,8 @@ export async function buildUserTurn({
     ...(effortConfiguration ? { effortConfiguration } : {}),
     // What its reminder told, read back by later turns (agent-listing-notice.mjs).
     ...(agentListingNotice ? { agentListing: agentListingNotice.meta } : {}),
+    // A retry resubmits this message as is: it acknowledges the same notice.
+    ...(promptSettingsNotice ? { promptSettingsNoticeRevision: promptSettingsNotice.revision } : {}),
   };
   const userTurnMessage = withRuntimeUserContext(
     {
@@ -228,6 +242,7 @@ export async function buildUserTurn({
     goalReminder,
     workflowNotice,
     orchestrationModeNotice,
+    promptSettingsNotice,
     agentListingNotice,
     workspaceNotice,
     setupNotice,

package/src/runtime/agent/orchestrator/session/manager/ask-turn-settle.mjs

@@ -10,6 +10,7 @@ import { acknowledgePendingDeferredToolDelta } from '../../runtime-core/deferred
 import { acknowledgePendingGoalReminder } from '../../runtime-core/goal-reminder.mjs';
 import { acknowledgePendingSetupNotice, acknowledgePendingWorkspaceNotice } from './prompt-utils.mjs';
 import { acknowledgePendingWorkflowNotice } from './workflow-switch-notice.mjs';
+import { acknowledgePendingPromptSettingsNotice } from './prompt-settings.mjs';
 import { acknowledgePendingOrchestrationModeNotice } from './orchestration-mode-switch-notice.mjs';
 import {
   finalizePendingMessageDelivery,
@@ -20,7 +21,7 @@ import { applyAskTerminalUsageTotals } from './usage-metrics.mjs';
 import { markSessionDone, markSessionEmptyFinal, _getRuntimeEntry } from './runtime-liveness.mjs';
 import { SessionClosedError } from './session-errors.mjs';
 import { filterModelVisibleSessionMessages } from './message-sanitize.mjs';
-import { clearTurnCheckpoint } from './turn-checkpoint.mjs';
+import { holdTurnUntilDurable } from './turn-durability.mjs';
 import { recordProviderContextBaseline } from '../loop/compact-policy.mjs';
 import { throwIfAborted } from '../../../../shared/abort-race.mjs';
 import { appendAssistantTurnMessage, persistProviderState, recordAskUsage } from './ask-turn-commit.mjs';
@@ -94,7 +95,7 @@ export function attachFailedTurnCompletion(messages, completion) {
 /** Commits the loop result into the session: messages, usage, provider state
  *  and queue acknowledgements. Returns the terminal result preview. */
 export async function commitAskTurn({ sessionId, opened, prepared, result, rawTranscriptMeta, askStartedAt }) {
-  const { turn, runtime, turnSignal, askGeneration, checkpoint, prepareCloseSnapshot } = opened;
+  const { turn, runtime, turnSignal, askGeneration, prepareCloseSnapshot } = opened;
   const session = turn.session;
   throwIfAborted(turnSignal);
   // Post-loop validation: if closeSession() landed while we were awaiting,
@@ -111,7 +112,8 @@ export async function commitAskTurn({ sessionId, opened, prepared, result, rawTr
   // Turn committed into session.messages; drop the live-turn alias so
   // contextStatus() reverts to the authoritative committed transcript.
   session.liveTurnMessages = null;
-  checkpoint.stop();
+  // The checkpoint keeps recording until publishAskTurn seals the finished
+  // transcript into it.
   delete session.activeTurnCheckpoint;
   appendAssistantTurnMessage({
     session,
@@ -142,6 +144,9 @@ export async function commitAskTurn({ sessionId, opened, prepared, result, rawTr
     acknowledgePendingGoalReminder(session, prepared.goalReminder.revision);
   }
   if (prepared.workflowNotice) acknowledgePendingWorkflowNotice(session, prepared.workflowNotice.revision);
+  if (prepared.promptSettingsNotice) {
+    acknowledgePendingPromptSettingsNotice(session, prepared.promptSettingsNotice.revision);
+  }
   if (prepared.orchestrationModeNotice) {
     acknowledgePendingOrchestrationModeNotice(session, prepared.orchestrationModeNotice.revision);
   }
@@ -160,7 +165,7 @@ export async function commitAskTurn({ sessionId, opened, prepared, result, rawTr
  *  starts the durable save and marks the session done. Returns the
  *  follow-up entries drained right after the provider accepted the turn. */
 export function publishAskTurn({ sessionId, opened, terminalResultPreview, askOpts, rawTranscriptMeta, askStartedAt }) {
-  const { turn, runtime, askGeneration, turnToken } = opened;
+  const { turn, runtime, askGeneration, turnToken, checkpoint } = opened;
   const session = turn.session;
   // The provider accepted this queued turn: only now remove its
   // durable ids. A crash before here leaves them for at-least-once
@@ -197,19 +202,23 @@ export function publishAskTurn({ sessionId, opened, terminalResultPreview, askOp
   // query/provider send (agentLoop pre-send), not after the previous
   // answer. This lets queued follow-up prompts resume immediately;
   // if they need compaction, their own spinner shows compacting first.
-  // Fire-and-forget terminal save. The result is already produced and
-  // (for agent surfaces) relayed via onTerminalResult above. When
-  // completion was relayed to the UI, yield before postMessage
-  // structured-clones the full session. Queued follow-up turns retain
-  // the original immediate-save ordering; they did not inject a
-  // terminal card and may mutate this same session on the next loop.
+  // The finished transcript (final assistant message, completion) is sealed
+  // into the checkpoint, and the record the terminal save writes names the
+  // turn it covers: a crash before that save lands replays the sealed turn,
+  // one after it deletes the checkpoint without a duplicate.
+  session.turnCoverage = turnToken;
+  checkpoint.seal();
+  // Terminal save. The result is already produced and (for agent surfaces)
+  // relayed via onTerminalResult above. When completion was relayed to the
+  // UI, yield before postMessage structured-clones the full session. Queued
+  // follow-up turns retain the original immediate-save ordering. Its landed
+  // acknowledgement is this session's next-turn gate (turn-durability.mjs),
+  // which alone deletes the checkpoint.
   const saveTerminalSession = terminalRelayed ? saveSessionAsyncDeferred : saveSessionAsync;
   const terminalSave = saveTerminalSession(session, { expectedGeneration: askGeneration });
+  holdTurnUntilDurable({ sessionId, session, turnToken, generation: askGeneration, save: terminalSave });
   terminalSave.then(
-    () => {
-      clearTurnCheckpoint(sessionId, turnToken);
-      ingestSessionTurn(session);
-    },
+    () => ingestSessionTurn(session),
     () => {}
   );
   finalizePendingMessageDelivery(session, turn.pendingEntries, terminalSave, () =>
@@ -227,7 +236,8 @@ export function publishAskTurn({ sessionId, opened, terminalResultPreview, askOp
   const isEmptyFinal =
     !terminalResultPreview.content &&
     !terminalResultPreview.reasoningContent &&
-    !terminalResultPreview.reactionCompleted;
+    !terminalResultPreview.reactionCompleted &&
+    !terminalResultPreview.reportContent;
   if (isEmptyFinal) {
     markSessionEmptyFinal(sessionId);
   }