mixdog 1.4.2 → 1.4.3

package/src/runtime/agent/orchestrator/session/manager/turn-durability.mjs

@@ -0,0 +1,144 @@
+// manager/turn-durability.mjs
+// One unsettled turn per session. A finished (or failed) turn stays
+// unsettled — its checkpoint kept — until a landed save of its session
+// carries the turn's coverage token (store/transcript-durability.mjs); only
+// that acknowledgement deletes the checkpoint. The next turn of the session
+// waits for it before it opens its own checkpoint or touches the session, and
+// a save that cannot land blocks that turn with a TurnPersistenceError
+// instead of releasing it. A settled promise, an idle queue or a coalesced,
+// cancelled or dropped write is never an acknowledgement. Sessions are
+// independent: nothing here waits on another session's saves.
+import { readSessionLifecycleFromDisk, saveSessionAsync } from '../store.mjs';
+import { landedTranscript, landedTranscriptMatches, mintTranscriptEpoch } from '../store/transcript-durability.mjs';
+import { clearTurnCheckpoint } from './turn-checkpoint.mjs';
+
+const _unsettled = new Map(); // sessionId → { session, turnToken, generation, ack, error }
+
+export class TurnPersistenceError extends Error {
+  constructor(sessionId, message, cause = null) {
+    super(`Session ${sessionId}: ${message}${cause ? ` (${cause.message || cause})` : ''}`);
+    this.name = 'TurnPersistenceError';
+    this.code = 'ETURNNOTDURABLE';
+    this.sessionId = sessionId;
+    if (cause) this.cause = cause;
+  }
+}
+
+// Split-brain re-adoption: another surface (e.g. desktop click-through
+// of a session still actively owned by this process) may have
+// resumed-and-detached this session, bumping the ON-DISK generation
+// while the conversation kept going here. Every save from this process
+// would then be silently dropped by _shouldDrop's ownership rule and
+// the on-disk transcript would freeze at the last landed save. A new
+// ask on a NON-closed session is an explicit ownership claim: adopt
+// the disk generation so this turn's commits land and heal the file.
+export function adoptDiskGeneration(session, sessionId) {
+  const diskLifecycle = readSessionLifecycleFromDisk(sessionId);
+  if (
+    diskLifecycle &&
+    diskLifecycle.closed !== true &&
+    diskLifecycle.generation > (typeof session.generation === 'number' ? session.generation : 0)
+  ) {
+    session.generation = diskLifecycle.generation;
+  }
+}
+
+/** Whether a landed save of `session` carries `turnToken`'s coverage. */
+export function turnCoveredOnDisk(session, turnToken) {
+  return landedTranscript(session)?.coverage === turnToken;
+}
+
+function release(sessionId, entry) {
+  if (_unsettled.get(sessionId) !== entry) return;
+  _unsettled.delete(sessionId);
+  clearTurnCheckpoint(sessionId, entry.turnToken);
+}
+
+/** Keep `turnToken` (already the session's `turnCoverage`) unsettled until a
+ *  landed save covers it; `save` is the save expected to. Resolves whether
+ *  it did. */
+export function holdTurnUntilDurable({ sessionId, session, turnToken, generation, save }) {
+  const entry = { session, turnToken, generation, error: null, ack: null };
+  _unsettled.set(sessionId, entry);
+  entry.ack = Promise.resolve(save)
+    .then(
+      () => turnCoveredOnDisk(session, turnToken),
+      (error) => {
+        entry.error = error;
+        return false;
+      }
+    )
+    .then((covered) => {
+      if (covered) release(sessionId, entry);
+      return covered;
+    });
+  return entry.ack;
+}
+
+/** Whether this process holds a turn of `sessionId` not yet durable. */
+export function hasUnsettledTurn(sessionId) {
+  return _unsettled.has(sessionId);
+}
+
+/** A closed or deleted session: nothing will open on it again. */
+export function forgetUnsettledTurn(sessionId) {
+  _unsettled.delete(sessionId);
+}
+
+/** Resolves once the previous turn of `sessionId` is durably covered (its
+ *  checkpoint then deleted). When its own save did not land it, one fresh
+ *  save of the finalized transcript is attempted; if that does not land
+ *  either, throws TurnPersistenceError and the checkpoint stays. A save the
+ *  ownership guard refused because another surface moved the disk generation
+ *  is retried under that generation: this ask is the ownership claim that
+ *  adoptDiskGeneration describes, and the retry stays guarded by it, so a
+ *  closed session or a further handoff still refuses it. */
+export async function awaitPreviousTurnDurable(sessionId) {
+  const entry = _unsettled.get(sessionId);
+  if (!entry || (await entry.ack)) return;
+  adoptDiskGeneration(entry.session, sessionId);
+  entry.generation = Math.max(entry.generation, entry.session.generation);
+  try {
+    await saveSessionAsync(entry.session, { expectedGeneration: entry.generation });
+  } catch (error) {
+    entry.error = error;
+  }
+  if (!turnCoveredOnDisk(entry.session, entry.turnToken)) {
+    throw new TurnPersistenceError(
+      sessionId,
+      'the previous turn is not saved to disk, so the next turn cannot start',
+      entry.error
+    );
+  }
+  release(sessionId, entry);
+}
+
+/** Make `session`'s current transcript durable, so a turn opening on it
+ *  names a base that is on disk. A transcript that is not a pure extension
+ *  of the last landed one (an unsaved rewrite) starts a new epoch first. */
+export async function ensureDurableTranscript(session) {
+  if (landedTranscriptMatches(session)) return;
+  const landed = landedTranscript(session);
+  const messages = Array.isArray(session.messages) ? session.messages : [];
+  const extendsLanded =
+    landed &&
+    landed.epoch === session.transcriptEpoch &&
+    landed.refs.length <= messages.length &&
+    landed.refs.every((message, index) => message === messages[index]);
+  if (typeof session.transcriptEpoch !== 'string' || (landed && !extendsLanded)) {
+    session.transcriptEpoch = mintTranscriptEpoch();
+  }
+  let failure = null;
+  try {
+    await saveSessionAsync(session, { expectedGeneration: session.generation });
+  } catch (error) {
+    failure = error;
+  }
+  if (!landedTranscriptMatches(session)) {
+    throw new TurnPersistenceError(
+      session.id,
+      'the conversation is not saved to disk, so the next turn cannot start',
+      failure
+    );
+  }
+}

package/src/runtime/agent/orchestrator/session/manager/turn-interruption.mjs

@@ -225,7 +225,7 @@ function textBufferMethods(state) {
       // The replayed attempt has started producing its OWN text, so the
       // retracted tail it replaces is no longer what the user is looking
       // at. Dropping it here keeps exactly one copy of the opening
-      // instead of one per retry (a 3-retry stall used to persist four
+      // instead of one per retry (a 3-retry stall would persist four
       // copies of the same first sentence). Reference agents never
       // commit a replayed attempt's discarded stream at all; the
       // tombstone exists only for the window between a retraction and

package/src/runtime/agent/orchestrator/session/manager/usage-metrics.mjs

@@ -8,6 +8,7 @@
 import { providerInputExcludesCache } from '../../providers/registry.mjs';
 import { reasoningUsage, combineReasoningUsage } from '../../../../shared/llm/reasoning-usage.mjs';
 import { foldUsageReadout } from '../../../../shared/usage-readout-totals.mjs';
+import { emitSessionActivityChange } from '../../../../shared/session-activity-signal.mjs';
 import {
   loadSession,
   saveSessionAsync,
@@ -560,6 +561,9 @@ export async function persistIterationMetrics(delta) {
     // saved before this field began at their first call after it.
     session.usageReadout = foldUsageReadout(session.usageReadout, delta, delta.requestMs);
     recordLastContextTokens(session, iterationContext(delta));
+    // The Agents pool shows each agent's running totals from this live
+    // counter: it re-reads on this pulse instead of the next throttled save.
+    emitSessionActivityChange(sessionId);
   }
   session.lastIterationIndex = iterationIndex;
   session.updatedAt = ts || Date.now();

package/src/runtime/agent/orchestrator/session/manager.mjs

@@ -65,7 +65,12 @@ export {
   settlePendingMessageWrites,
   markCompletionEntry,
   COMPLETION_NOTIFICATION_KIND,
+  hasPendingMessages,
 } from './manager/pending-messages.mjs';
+// The per-session ask mutex every turn holds, tried without waiting, and the
+// unsettled-turn check: the idle-only delete (session-delete.mjs) acts under them.
+export { tryAcquireSessionLock, sessionLockContended } from './manager/session-lock.mjs';
+export { hasUnsettledTurn } from './manager/turn-durability.mjs';
 
 // ── Usage-metrics surface — re-exported unchanged so loop.mjs / smoke scripts
 //    keep resolving these through the facade. ────────────────────────────────
@@ -96,6 +101,7 @@ export { prewarmAgentLoop } from './manager/runtime-loaders.mjs';
 export {
   createSession,
   updateSessionRoute,
+  holdSessionRoute,
   prefetchSession,
   prepareSessionProjection,
   resumeSession,

package/src/runtime/agent/orchestrator/session/mixy-name.mjs

@@ -15,7 +15,7 @@ import { mixyIdentityDir } from '../../../shared/agent-store.mjs';
 export const DEFAULT_MIXY_NAME = 'Mixy';
 
 /** The display name in a lead manifest (agent.json), else Mixy. */
-export function mixyNameOf(manifest) {
+function mixyNameOf(manifest) {
   const name = typeof manifest?.name === 'string' ? manifest.name.replace(/\s+/g, ' ').trim() : '';
   return name || DEFAULT_MIXY_NAME;
 }

package/src/runtime/agent/orchestrator/session/pre-send-compact.mjs

@@ -41,6 +41,7 @@ import {
   snapshotPendingGoalReminder,
 } from '../runtime-core/goal-reminder.mjs';
 import { rearmLateDeferredTools } from '../runtime-core/tool-catalog.mjs';
+import { rearmPromptSettingsNotice } from './manager/prompt-settings.mjs';
 
 async function setStage(opts, stage) {
   try {
@@ -437,7 +438,12 @@ function adoptCompactedTranscript(ctx, run) {
   // The system prompt is rebuilt from current sources outside a running turn
   // (session-runtime agent-profile-fold.mjs): the next cold point folds it in
   // instead of adding a break to the turn that is already warm again.
-  if (sessionRef) sessionRef.promptFoldPending = true;
+  // The fold runs at the next turn start (compactionFoldPending): it lists the
+  // late tools and the settings this compaction dropped the notices of.
+  if (sessionRef) {
+    sessionRef.promptFoldPending = true;
+    sessionRef.compactionFoldPending = true;
+  }
   resetReadStateAfterCompaction(sessionId);
   // Cross-turn receipts reference tool results that compaction just removed
   // from context; a stub for them would point at nothing. Clear in place so
@@ -573,6 +579,7 @@ async function compactBeforeSend(ctx) {
     // The adopted compaction strips late MCP tool announcements from older turns.
     try {
       rearmLateDeferredTools(sessionRef);
+      rearmPromptSettingsNotice(sessionRef);
     } catch {
       /* best-effort, like the Goal reminder: a tool reminder never fails the compaction */
     }

package/src/runtime/agent/orchestrator/session/save-session-worker.mjs

@@ -60,9 +60,13 @@ parentPort.on('message', (message) => {
     }
     return;
   }
-  const { session, delta, id, opts, reqId } = message || {};
+  const { session, delta, id, opts, reqId, dataDir } = message || {};
   let full = session;
   try {
+    // This realm's env was copied when the worker spawned; the parent's data
+    // dir may have moved since (save-worker.mjs _postAsyncWrite), and every
+    // path below resolves it from the env at call time.
+    if (dataDir) process.env.MIXDOG_DATA_DIR = dataDir;
     const sessionId = id ?? session?.id;
     if (!full && delta) {
       const base = _baseMessages.get(sessionId);

package/src/runtime/agent/orchestrator/session/store/canonical-reader.mjs

@@ -190,7 +190,7 @@ export function withdrawPendingOwnCommit(target, scratchStamp) {
 }
 
 /** Read-only lifecycle verdict of a pending peer commit whose identity `stamp` carries. */
-export function pendingOwnCommittedLifecycle(target, stamp) {
+function pendingOwnCommittedLifecycle(target, stamp) {
   _absorbPeerCommits();
   const pending = _pendingOwnCommits.get(target);
   return pending && _sameScratchIdentity(pending.stamp, stamp) ? pending.value : null;

package/src/runtime/agent/orchestrator/session/store/liveness-veto.mjs

@@ -17,7 +17,7 @@ import { probePath, readTextFile, PROBE_PRESENT } from './fs-probe.mjs';
 export const LEGACY_MARKER_SUFFIXES = ['.hb', '.own'];
 // An older live owner rewrote `.hb` every ≤5s mid-turn and `.own` every ~20s
 // while holding the session open; one untouched this long holds nothing.
-export const LEGACY_MARKER_FRESH_MS = 2 * 60 * 1000;
+const LEGACY_MARKER_FRESH_MS = 2 * 60 * 1000;
 
 function processAlive(pid) {
   try {
@@ -47,7 +47,7 @@ export function readLegacyMarker(path, now = Date.now()) {
 
 /** Whether a legacy marker of the session names a live owner pid with a
  *  fresh heartbeat: that session is driven by another live process. */
-export function _legacyOwnerLivenessVeto(id, now = Date.now()) {
+function _legacyOwnerLivenessVeto(id, now = Date.now()) {
   if (typeof id !== 'string' || !/^[A-Za-z0-9_-]+$/.test(id)) return false;
   const dir = getStoreDir();
   return LEGACY_MARKER_SUFFIXES.some((suffix) => {

package/src/runtime/agent/orchestrator/session/store/save-worker.mjs

@@ -18,6 +18,8 @@ import {
   _acquireSessionIncarnation,
   _releaseSessionIncarnation,
   _isCurrentSessionIncarnation,
+  SAVE_OUTCOME_SAVED,
+  SAVE_OUTCOME_DROPPED,
   SAVE_OUTCOME_STALE,
 } from './live-state.mjs';
 import {
@@ -33,6 +35,8 @@ import {
   _sessionStoreTestMode,
 } from './save-fault.mjs';
 import { connectOwnCommitPeer } from './canonical-reader.mjs';
+import { getPluginData } from '../../config.mjs';
+import { captureTranscriptSnapshot, recordLandedTranscript } from './transcript-durability.mjs';
 
 // ── Worker-thread async save ──────────────────────────────────────────────────
 // Single long-lived Worker serializes all saveSessionAsync calls.
@@ -278,6 +282,7 @@ function _settleLandedWrite(
     // built — never a row re-derived from the live session, which
     // may already carry a newer (unwritten, possibly failing) turn.
     _queueSessionSummaryUpsertRow(summaryRow, summaryVersion);
+    recordLandedTranscript(p.session, p.transcript, epoch);
     // ONLY a landed write proves durability, so this is the only
     // place the save-failure flag may be cleared — and only when
     // THIS payload is at least as new as the newest failed/dropped
@@ -304,7 +309,14 @@ function _settleLandedWrite(
     _rollbackCachedSessionSummary(id, summaryVersion);
     _recordSaveDrop(id, epoch);
   }
-  for (const w of waiters) w.resolve();
+  // Callers that act only on a durable write (e.g. a migration deleting its
+  // source) read this outcome; every other resolution leaves it undefined.
+  const settled = saved
+    ? SAVE_OUTCOME_SAVED
+    : outcome === SAVE_OUTCOME_STALE
+      ? SAVE_OUTCOME_STALE
+      : SAVE_OUTCOME_DROPPED;
+  for (const w of waiters) w.resolve(settled);
 }
 
 /**
@@ -531,6 +543,9 @@ function _postAsyncWrite(
   { forceFull = false, retriedFull = false } = {}
 ) {
   const reqId = ++_saveWorkerReqId;
+  // Before the bytes are built: what this write will prove durable once it
+  // lands (store/transcript-durability.mjs).
+  const transcript = captureTranscriptSnapshot(session);
   // The wire payload is built at POST time from the live session: N calls
   // coalesced behind one in-flight write project ONCE (newest state), and a
   // pure-append turn ships only the tail (see _buildWirePayload).
@@ -548,6 +563,7 @@ function _postAsyncWrite(
   _saveWorkerPending.set(reqId, {
     id,
     session,
+    transcript,
     attempt,
     opts,
     summaryVersion,
@@ -567,7 +583,12 @@ function _postAsyncWrite(
     // Cheap key compare; posts only when the fault config/env moved.
     _syncFaultToWorker(w);
     const { attempt: _attempt, ...wireForPost } = wire;
-    w.postMessage({ ...wireForPost, id, opts, reqId });
+    // The worker's process.env is a copy taken at spawn, so a data dir that
+    // moved since (a pristine headless run per page) would otherwise keep
+    // receiving writes in the first run's removed directory. The dir current
+    // at POST time travels with the write: a write still queued in the worker
+    // when the env flips lands where its own session lives.
+    w.postMessage({ ...wireForPost, id, opts, reqId, dataDir: getPluginData() });
     // Ref AFTER successful postMessage so a queue/throw failure path does
     // not leave the worker held alive with no pending message. Paired with
     // the unref in the message handler when count hits 0.

package/src/runtime/agent/orchestrator/session/store/sweep/sub-agent-retention.mjs

@@ -16,12 +16,12 @@ import { deleteSession } from '../session-delete.mjs';
 import { readSweepRecord } from './sweep-record.mjs';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
-export const SUB_AGENT_ARCHIVE_AFTER_MS = 3 * DAY_MS;
-export const SUB_AGENT_DELETE_AFTER_MS = 30 * DAY_MS;
+const SUB_AGENT_ARCHIVE_AFTER_MS = 3 * DAY_MS;
+const SUB_AGENT_DELETE_AFTER_MS = 30 * DAY_MS;
 const PERMANENT_ID = /^sess_(?:home|room|rmem)_/;
 // The desktop change an automatic archive applies: that one session, no
 // cascade (an explicit archive of a parent takes its sub-agents along).
-export const SUB_AGENT_AUTO_ARCHIVE = Object.freeze({ archived: true, cascade: false });
+const SUB_AGENT_AUTO_ARCHIVE = Object.freeze({ archived: true, cascade: false });
 
 const positive = (value) => (Number(value) > 0 ? Number(value) : 0);
 

package/src/runtime/agent/orchestrator/session/store/transcript-durability.mjs

@@ -0,0 +1,88 @@
+// store/transcript-durability.mjs
+// What a session's canonical record durably holds, as evidence for the turn
+// checkpoints (manager/turn-checkpoint.mjs) — never inferred from in-memory
+// freshness.
+//
+//   transcriptEpoch  persisted. Names one append-only lineage of the
+//                    transcript: a record of epoch E with `length` messages
+//                    agrees with every other record of E on their common
+//                    prefix. A history rewrite (compaction, a prefix edit,
+//                    a recovery splice) mints a new epoch.
+//   turnCoverage     persisted. The token of the last turn whose finalized
+//                    transcript this record carries, so a checkpoint the
+//                    record already covers is deleted, never replayed.
+//
+// A landed save records, per session object, the exact epoch, coverage and
+// message references it serialized (captured when the bytes were built, so a
+// coalesced or later-built write reports what it actually wrote). Only that
+// record proves what is on disk; a settled promise or an idle queue does not.
+import { randomUUID } from 'node:crypto';
+import { basename, dirname } from 'node:path';
+import { sessionPath } from './session-paths.mjs';
+import { _storedSessionFromFile, STORED_SESSION_UNREADABLE } from './serialize.mjs';
+
+const _landed = new WeakMap(); // session → { epoch, coverage, refs, saveEpoch }
+const _snapshotHooks = new WeakMap(); // session → () => void
+
+export function mintTranscriptEpoch() {
+  return randomUUID();
+}
+
+/** Run `hook` before every serialization of `session` (the turn checkpoint
+ *  journals a history rewrite, under a new epoch, before any record carries
+ *  it). Returns the unregister function. */
+export function setTranscriptSnapshotHook(session, hook) {
+  _snapshotHooks.set(session, hook);
+  return () => {
+    if (_snapshotHooks.get(session) === hook) _snapshotHooks.delete(session);
+  };
+}
+
+/** The transcript identity a save of `session` is about to serialize. */
+export function captureTranscriptSnapshot(session) {
+  _snapshotHooks.get(session)?.();
+  return {
+    epoch: typeof session.transcriptEpoch === 'string' ? session.transcriptEpoch : null,
+    coverage: typeof session.turnCoverage === 'string' ? session.turnCoverage : null,
+    refs: Array.isArray(session.messages) ? session.messages.slice() : [],
+  };
+}
+
+/** A save of `snapshot` (issued under `saveEpoch`) landed on disk. */
+export function recordLandedTranscript(session, snapshot, saveEpoch) {
+  if (!session || !snapshot) return;
+  const current = _landed.get(session);
+  const issued = Number.isFinite(saveEpoch) ? saveEpoch : 0;
+  if (current && current.saveEpoch > issued) return;
+  _landed.set(session, { ...snapshot, saveEpoch: issued });
+}
+
+export function landedTranscript(session) {
+  return (session && _landed.get(session)) || null;
+}
+
+/** Whether the last landed save of `session` holds exactly its transcript. */
+export function landedTranscriptMatches(session) {
+  const landed = landedTranscript(session);
+  const messages = Array.isArray(session?.messages) ? session.messages : null;
+  if (!landed || !messages || landed.epoch !== session.transcriptEpoch) return false;
+  if (landed.refs.length !== messages.length) return false;
+  return landed.refs.every((message, index) => message === messages[index]);
+}
+
+/** The durable transcript a turn opening now would be taken against
+ *  (`{ epoch, refs }`), or null when no landed save holds `session`'s
+ *  current transcript exactly. */
+export function durableTranscriptBase(session) {
+  if (!landedTranscriptMatches(session)) return null;
+  const landed = landedTranscript(session);
+  return { epoch: landed.epoch, refs: landed.refs };
+}
+
+/** The canonical record of `id` as it is on disk (never a cached or live
+ *  copy), or null when it is absent, unreadable or not this session's. */
+export function readDurableSessionRecord(id) {
+  const path = sessionPath(id);
+  const record = _storedSessionFromFile(dirname(path), basename(path));
+  return record && record !== STORED_SESSION_UNREADABLE ? record : null;
+}

package/src/runtime/agent/orchestrator/session/store-agent-worker-rows.mjs

@@ -42,6 +42,7 @@ import {
 import { dataDir, storedAgentWorkerIndexPath, storedLeadWorkerIndexPath } from './store-summary-locations.mjs';
 import { cleanValue, isStoredSessionId, positiveNumber } from './store-summary-fields.mjs';
 import { sessionUsageTotals } from '../../../shared/session-usage-totals.mjs';
+import { todoProgress } from '../runtime-core/todo-list.mjs';
 
 const WORKING_AGENT_STATUS =
   /^(?:connecting|requesting|streaming|tool[-_\s]?running|running|queued|pending|starting|cancelling)$/i;
@@ -327,6 +328,7 @@ const WORKER_HEADER_FIELDS = [
   'totalInputTokens',
   'totalOutputTokens',
   'totalToolCalls',
+  'todo',
   ...SESSION_CANCEL_FIELDS,
 ];
 
@@ -584,6 +586,7 @@ function projectChildWorkerRow(row, context) {
   // beside a header that records a cancel-unconfirmed (possibly running)
   // process. A new row may precede its first session save (null header).
   const session = readWorkerSessionHeader(sessionId);
+  const todo = todoProgress(session);
   const declaredStatus = cleanValue(row.status) || 'running';
   const declaredStage = cleanValue(row.stage || row.status) || 'running';
   const declaredWorking = WORKING_AGENT_STATUS.test(workerLifecycle(row) || 'running');
@@ -649,6 +652,8 @@ function projectChildWorkerRow(row, context) {
     clientHostPid: positiveNumber(row.clientHostPid || session?.clientHostPid, 0) || null,
     taskId: cleanValue(row.task_id || row.taskId) || null,
     ...sessionUsageTotals(session),
+    // The agent's own step list as counts only; a closed agent keeps its last.
+    ...(todo ? { todo } : {}),
   };
 }
 

package/src/runtime/agent/orchestrator/session/store-summary-log.mjs

@@ -19,7 +19,7 @@
 import { readFileSync, statSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 
-export const SUMMARY_LOG_FILENAME = 'session-summaries.log';
+const SUMMARY_LOG_FILENAME = 'session-summaries.log';
 
 export function summaryLogPath(indexPath) {
   return join(dirname(indexPath), SUMMARY_LOG_FILENAME);

package/src/runtime/agent/orchestrator/session/store-transcript-projection.mjs

@@ -15,6 +15,7 @@ import { join } from 'node:path';
 import { desktopSession, positiveNumber } from './store-summary-fields.mjs';
 import { compactionArchiveRange, readCompactionArchivePage } from './compaction-archive.mjs';
 import { dataDir } from './store-summary-locations.mjs';
+import { todoSnapshot } from '../runtime-core/todo-list.mjs';
 
 /** The parse/recovery/projection body of a stored transcript read. Runs once
  *  per distinct content; its result is shared read-only through the cache. */
@@ -40,7 +41,9 @@ export async function prepareStoredTranscriptBase(sessionId, doc, options) {
     // A running turn is never recovered: project its checkpoint read-only.
     if (isSessionTurnLive(sessionId)) projectCheckpoint();
     else {
-      session = recoverSessionAfterProcessRestart(sessionId) || session;
+      // `doc` is the record exactly as this read parsed it from disk: the
+      // durable evidence recovery decides on.
+      session = recoverSessionAfterProcessRestart(sessionId, doc) || session;
       // A closed session keeps its marker unrecovered.
       if (session?.activeTurnCheckpoint) projectCheckpoint();
     }
@@ -78,9 +81,10 @@ export async function prepareStoredTranscriptBase(sessionId, doc, options) {
   }
   const messages = Array.isArray(session.messages) ? session.messages : [];
   const hasConversationActivity = messages.some((message) => message?.role === 'user');
-  const measuredStats = contextMeasurementStats({
-    measurement: sessionContextMeasurement(session, hasConversationActivity),
-  });
+  const measuredStats = {
+    ...contextMeasurementStats({ measurement: sessionContextMeasurement(session, hasConversationActivity) }),
+    usageReadout: session.usageReadout || null,
+  };
   const contextWindow = positiveNumber(session.contextWindow);
   const rawContextWindow = positiveNumber(session.rawContextWindow, contextWindow);
   const displayContextWindow = positiveNumber(session.compactBoundaryTokens, contextWindow);
@@ -218,7 +222,7 @@ function budgetedEdge(from, step, length, rows, byteBudget, sizeOf) {
 }
 
 /** The most rows one historical-position read carries, whatever it asks. */
-export const CURSOR_PAGE_MAX_ROWS = 512;
+const CURSOR_PAGE_MAX_ROWS = 512;
 
 /** A cursor's page size: 1 to CURSOR_PAGE_MAX_ROWS rows. */
 export function cursorPageRows(maxRows) {
@@ -305,6 +309,11 @@ export async function windowStoredTranscript(sessionId, base, options) {
     cwd: session.cwd || '',
     desktopSession: desktopSession(session.desktopSession, session.cwd),
     workflow: session.workflow || null,
+    todo: todoSnapshot(session),
+    // Turns whose checkpoints recovery could not apply, kept on disk.
+    ...(Array.isArray(session.unrecoveredTurns) && session.unrecoveredTurns.length
+      ? { unrecoveredTurns: session.unrecoveredTurns }
+      : {}),
     ...contextFields,
   };
 }

package/src/runtime/agent/orchestrator/session/store-transcript-worker.mjs

@@ -337,8 +337,8 @@ const baseBuilds = createBaseBuilds({ build: buildBase });
 // history) and a page of a retained one costs ~0.2 s, a rebuilt one ~1 s. 96
 // MB keeps the largest sessions seen (~78 MB records) smooth; 128 MB holds
 // one of those beside a few ordinary ones.
-export const WORKER_HISTORY_SESSION_MAX_BYTES = 96 * 1024 * 1024;
-export const WORKER_HISTORY_MAX_BYTES = 128 * 1024 * 1024;
+const WORKER_HISTORY_SESSION_MAX_BYTES = 96 * 1024 * 1024;
+const WORKER_HISTORY_MAX_BYTES = 128 * 1024 * 1024;
 
 /**
  * The display histories one worker retains (`{ value, rowBytes, bytes }`,

package/src/runtime/agent/orchestrator/session/store.mjs

@@ -31,6 +31,7 @@ export {
   _removeSessionSummary,
 } from './store-summary-index.mjs';
 import { _sessionForDisk, _ensureLifecycleFields } from './store/serialize.mjs';
+import { captureTranscriptSnapshot, recordLandedTranscript } from './store/transcript-durability.mjs';
 import {
   _cacheSessionSummary,
   _rollbackCachedSessionSummary,
@@ -337,6 +338,7 @@ function _doSaveSync(payload) {
     // rebuilt from them, never re-read from the later mutable live session.
     let attempted = null;
     try {
+      const transcript = captureTranscriptSnapshot(session);
       const disk = _sessionForDisk(session);
       attempted = JSON.stringify(disk);
       // The lifecycle these exact bytes carry, recorded with the commit stamp.
@@ -382,6 +384,7 @@ function _doSaveSync(payload) {
         _recordOwnSessionCommit(target, scratch, lifecycle);
         _publishLandedWriteEpoch(opts, epoch);
         _untrackSaveTmp(tmp);
+        recordLandedTranscript(session, transcript, epoch);
         if (mayMutate()) {
           if (publishSummary) _queueSessionSummaryUpsert(session, summaryVersion);
           _clearSaveStateIfCurrent(id, epoch);
@@ -627,6 +630,7 @@ async function _doSave(payload) {
   // payload, never the live session as it looks at settlement time.
   let attempted = null;
   try {
+    const transcript = captureTranscriptSnapshot(session);
     const disk = _sessionForDisk(session);
     attempted = JSON.stringify(disk);
     // Captured before the await: the lifecycle of exactly these bytes.
@@ -671,6 +675,7 @@ async function _doSave(payload) {
       _recordOwnSessionCommit(target, scratch, lifecycle);
       _publishLandedWriteEpoch(opts, epoch);
       _untrackSaveTmp(tmp);
+      recordLandedTranscript(session, transcript, epoch);
       if (mayMutate()) {
         _queueSessionSummaryUpsert(session, summaryVersion);
         _clearSaveStateIfCurrent(id, epoch);

package/src/runtime/agent/orchestrator/session/synthetic-user-envelope.mjs

@@ -45,6 +45,11 @@ const RUNTIME_CONTROL_SOURCES = new Set([
   'task-notification',
 ]);
 const ENVELOPE_OPEN_RE = new RegExp(`^\\s*<${SYNTHETIC_USER_ENVELOPE_TAG}\\b`, 'i');
+// The stored crash marker reads like a user cancel ("Request interrupted ..."),
+// and models answered it with "stopped as you asked" and dropped the work.
+// On the wire it names the restart and asks to resume.
+const PROCESS_RESTART_MARKER = '[Request interrupted by process restart]';
+const PROCESS_RESTART_WIRE_TEXT = '[mixdog-runtime] The app restarted mid-turn. Continue from where you left off.';
 
 function messageText(message) {
   if (typeof message?.content === 'string') return message.content;
@@ -128,7 +133,8 @@ export function projectSyntheticUserEnvelopes(messages) {
   const projected = messages.map((message) => {
     const kind = classifySyntheticUserMessage(message);
     if (!kind) return message;
-    const content = envelopeContent(message.content, kind);
+    const source = messageText(message).trim() === PROCESS_RESTART_MARKER ? PROCESS_RESTART_WIRE_TEXT : message.content;
+    const content = envelopeContent(source, kind);
     if (content === message.content) return message;
     changed = true;
     stats.wrapped += 1;

package/src/runtime/agent/orchestrator/session/tail-reminder-rules.mjs

@@ -119,7 +119,15 @@ export function matchTailReminder(context, rules = TAIL_REMINDER_RULES) {
 }
 
 /** `messages` plus the tail reminder for this request (a copy; the input is untouched). */
-export function withTailReminder(messages, { session, provider, model }, language = _buildLeadLanguage()) {
+// The session's own response language (as its prompt and settings notices
+// carry it, session/manager/prompt-settings.mjs); a session without one (an
+// agent, an older record) reads the config.
+export function withTailReminder(
+  messages,
+  { session, provider, model },
+  // null is a recorded "no language", not a missing record.
+  language = session?.responseLanguage !== undefined ? session.responseLanguage : _buildLeadLanguage()
+) {
   const text = matchTailReminder({
     provider: session?.provider || provider?.name || '',
     model,