mixdog 1.4.2 → 1.4.3

package/src/runtime/agent/orchestrator/providers/xai-tool-search-head-parity.json

@@ -55,9 +55,7 @@
       }
     ],
     "store": false,
-    "include": [
-      "reasoning.encrypted_content"
-    ],
+    "include": ["reasoning.encrypted_content"],
     "prompt_cache_key": "f0858c98-2db1-4764-9d18-e6e1ec2ea4c7",
     "tools": [
       {
@@ -148,9 +146,7 @@
       }
     ],
     "store": false,
-    "include": [
-      "reasoning.encrypted_content"
-    ],
+    "include": ["reasoning.encrypted_content"],
     "prompt_cache_key": "f0858c98-2db1-4764-9d18-e6e1ec2ea4c7",
     "tools": [
       {
@@ -278,9 +274,7 @@
       }
     ],
     "store": false,
-    "include": [
-      "reasoning.encrypted_content"
-    ],
+    "include": ["reasoning.encrypted_content"],
     "prompt_cache_key": "f0858c98-2db1-4764-9d18-e6e1ec2ea4c7",
     "tools": [
       {
@@ -400,9 +394,7 @@
       }
     ],
     "store": false,
-    "include": [
-      "reasoning.encrypted_content"
-    ],
+    "include": ["reasoning.encrypted_content"],
     "prompt_cache_key": "f0858c98-2db1-4764-9d18-e6e1ec2ea4c7",
     "instructions": "sys",
     "tools": [
@@ -513,9 +505,7 @@
       }
     ],
     "store": false,
-    "include": [
-      "reasoning.encrypted_content"
-    ],
+    "include": ["reasoning.encrypted_content"],
     "prompt_cache_key": "f0858c98-2db1-4764-9d18-e6e1ec2ea4c7",
     "tools": [
       {
@@ -626,9 +616,7 @@
       }
     ],
     "store": false,
-    "include": [
-      "reasoning.encrypted_content"
-    ],
+    "include": ["reasoning.encrypted_content"],
     "prompt_cache_key": "f0858c98-2db1-4764-9d18-e6e1ec2ea4c7",
     "tools": [
       {
@@ -738,9 +726,7 @@
       }
     ],
     "store": false,
-    "include": [
-      "reasoning.encrypted_content"
-    ],
+    "include": ["reasoning.encrypted_content"],
     "prompt_cache_key": "f0858c98-2db1-4764-9d18-e6e1ec2ea4c7",
     "tools": [
       {
@@ -865,9 +851,7 @@
       }
     ],
     "store": false,
-    "include": [
-      "reasoning.encrypted_content"
-    ],
+    "include": ["reasoning.encrypted_content"],
     "prompt_cache_key": "f0858c98-2db1-4764-9d18-e6e1ec2ea4c7",
     "tools": [
       {
@@ -971,9 +955,7 @@
       }
     ],
     "store": false,
-    "include": [
-      "reasoning.encrypted_content"
-    ],
+    "include": ["reasoning.encrypted_content"],
     "prompt_cache_key": "f0858c98-2db1-4764-9d18-e6e1ec2ea4c7",
     "tools": [
       {
@@ -1078,9 +1060,7 @@
       }
     ],
     "store": false,
-    "include": [
-      "reasoning.encrypted_content"
-    ],
+    "include": ["reasoning.encrypted_content"],
     "prompt_cache_key": "f0858c98-2db1-4764-9d18-e6e1ec2ea4c7",
     "tools": [
       {

package/src/runtime/agent/orchestrator/runtime-core/builtin-features.mjs

@@ -129,6 +129,36 @@ export function builtinFeatureActive(configLike, id) {
   return false;
 }
 
+/** Every tool a settings gate of featureDisallowedToolsFor can deny (the
+ *  headless `load_tool` rule derives from these and is not a setting). */
+export const FEATURE_GATED_TOOL_NAMES = Object.freeze([
+  'web_search',
+  'web_fetch',
+  'memory',
+  'recall',
+  'git',
+  'github',
+  'browser',
+  'browser_devtools',
+  'computer',
+  'terminal',
+  'office',
+  'media',
+  'tidy',
+  'visualize',
+  'explore',
+  'react',
+]);
+
+/** Gated by desktop bridge presence, not a setting. */
+const BRIDGE_GATED_TOOL_NAMES = Object.freeze(['browser', 'browser_devtools', 'computer', 'terminal']);
+
+/** The tools a user setting turns off (react answers for itself: it gates
+ *  non-model callers too). */
+export const SETTING_GATED_TOOL_NAMES = Object.freeze(
+  FEATURE_GATED_TOOL_NAMES.filter((name) => !BRIDGE_GATED_TOOL_NAMES.includes(name) && name !== 'react')
+);
+
 /** The session-surface exclusion list. Session build, the empty-session policy
  *  refresh, and the deferred tool catalog all consume THIS list, so an
  *  uninstalled or disabled feature never reaches a session's tool surface.

package/src/runtime/agent/orchestrator/runtime-core/config-helpers.mjs

@@ -348,17 +348,6 @@ export function resolveAutoClearIdleMs(config, provider) {
   return autoClearIdleMsForProvider(provider, raw.providerIdleMs);
 }
 
-/** The idle auto-clear gate's settings for a thread on `provider`
- *  (idle-auto-clear-gate.mjs): `{ enabled, idleMs, minContextPercent }`. */
-function autoClearGateSettings(config, provider) {
-  const normalized = normalizeAutoClearConfig(config?.autoClear);
-  return {
-    enabled: normalized.enabled,
-    idleMs: resolveAutoClearIdleMs(config, provider),
-    minContextPercent: normalized.minContextPercent,
-  };
-}
-
 export function normalizeSystemShellConfig(value = {}) {
   const raw = value && typeof value === 'object' ? value : {};
   const command = clean(raw.command);

package/src/runtime/agent/orchestrator/runtime-core/deferred-tool-availability.mjs

@@ -14,6 +14,14 @@ export function sessionDisallows(session, name) {
   );
 }
 
+/** A settings gate denies `name` to the session (as last reconciled, tool-availability.mjs). */
+export function sessionFeatureDenies(session, name) {
+  return (
+    Array.isArray(session?.featureDeniedTools) &&
+    session.featureDeniedTools.some((denied) => lowerName(denied) === lowerName(name))
+  );
+}
+
 /**
  * The session's own tool policy permits `name`: discovery (load_tool by name
  * or query) shows, selects and describes only what execution would run.

package/src/runtime/agent/orchestrator/runtime-core/deferred-tool-delta.mjs

@@ -2,12 +2,15 @@ import { clean } from './session-text.mjs';
 import { parseMcpToolName } from '../../../shared/tool-primitives.mjs';
 import { mcpServerLines } from '../context/deferred-tools.mjs';
 
+// A delta names tools; its description is a hint, the schema arrives on load.
+export const DELTA_DESCRIPTION_MAX = 80;
+
 function compactDescription(value) {
-  return String(value || '')
+  const text = String(value || '')
     .replace(/\s+/g, ' ')
     .replace(/[<>]/g, '')
-    .trim()
-    .slice(0, 240);
+    .trim();
+  return text.length > DELTA_DESCRIPTION_MAX ? `${text.slice(0, DELTA_DESCRIPTION_MAX - 1).trimEnd()}…` : text;
 }
 
 function addedEntry(entry) {
@@ -168,6 +171,17 @@ export function snapshotPendingDeferredToolDelta(session) {
   };
 }
 
+/** Drop pending additions the prompt now lists itself (`listed`). */
+export function dropPendingDeferredToolAdds(session, listed) {
+  const pending = session?.pendingDeferredToolDelta;
+  if (!pending || !Array.isArray(pending.added)) return;
+  const added = pending.added.filter((entry) => !listed.has(clean(entry?.name)));
+  if (added.length === pending.added.length) return;
+  if (!added.length && !(pending.removed || []).length) delete session.pendingDeferredToolDelta;
+  else session.pendingDeferredToolDelta = { ...pending, added };
+  session.updatedAt = Date.now();
+}
+
 export function acknowledgePendingDeferredToolDelta(session, revision) {
   if (!session || typeof session !== 'object') return false;
   const current = normalizedDelta(session.pendingDeferredToolDelta);

package/src/runtime/agent/orchestrator/runtime-core/goal-control.mjs

@@ -5,21 +5,20 @@
  */
 import { durationLabel } from './goal-text.mjs';
 import { compactSessionTitle } from './session-title.mjs';
-import { applyGoalTaskChanges, optionalGoalTaskChanges } from './goal-tasks.mjs';
 import {
   NO_DEADLINE_WARNING_MS,
   activateGoal,
   activeElapsedMs,
   assertSessionId,
   clearTurnFailures,
-  goalTimeMode,
   parseGoalDuration,
   parseUserCommand,
+  publicGoal,
   resumeGoalState,
   stopActiveClock,
   validateObjective,
 } from './goal-state.mjs';
-import { assertExpectedGoal, goalFinished } from './goal-mutations.mjs';
+import { assertExpectedGoal, goalFinished, goalStalled } from './goal-mutations.mjs';
 import { clean } from '../../../shared/clean.mjs';
 
 /** "12m remaining" for a budgeted Goal, "3m elapsed" for an open-ended one. */
@@ -31,6 +30,9 @@ function goalTimingLabel(goal) {
 
 const reply = (action, goal, message) => ({ ok: true, action, goal, message });
 
+/** `code` of the create answer that asks the user to confirm replacing a stalled Goal. */
+export const GOAL_REPLACE_REQUIRED = 'goal-replace-required';
+
 const GOAL_CONTROL_ACTIONS = {
   async stop(ctx, { id, expectedGoalId, action }) {
     const goal = await ctx.abandonGoal(id, { expectedGoalId, archive: true });
@@ -52,34 +54,27 @@ const GOAL_CONTROL_ACTIONS = {
       throw new Error('a completed Goal cannot be resumed; edit it or create a new Goal');
     }
     const added = args.duration ? parseGoalDuration(args.duration) : null;
-    const timeMode = goalTimeMode(args.timeMode, goal.timeMode);
-    // Empty optional fields from frozen provider schemas still mean a plain
-    // resume. Supplied changes validate before activation and share its write.
-    const taskChanges = optionalGoalTaskChanges(args);
-    const hasTaskChanges = [taskChanges.updates, taskChanges.tasks].some(
-      (value) => value != null && (!Array.isArray(value) || value.length > 0)
-    );
-    if (hasTaskChanges) applyGoalTaskChanges(goal, taskChanges, { partial: true, at });
     resumeGoalState(goal, at, added);
-    goal.timeMode = timeMode;
     const resumed = await ctx.commit(id, goal);
     return reply(action, resumed, `Goal resumed · ${resumed.objective} · ${goalTimingLabel(resumed)}`);
   },
   async edit(ctx, { id, goal, args, at, action }) {
-    // Tasks survive an objective edit. The desktop "Edit goal" button drafts
-    // the CURRENT objective, so wiping the list meant refining one word threw
-    // away every completed row; re-aligning a stale list is set_tasks' job.
+    // The session's todo list is untouched by an objective edit; the
+    // objective-updated reminder asks the model to re-align it.
     const objective = validateObjective(args.objective);
     let timeLimitMs = goal.timeLimitMs;
-    if (args.timeLimitMs != null) timeLimitMs = args.timeLimitMs === 0 ? 0 : parseGoalDuration(args.timeLimitMs);
-    else if (args.duration != null) timeLimitMs = parseGoalDuration(args.duration);
-    const timeMode = goalTimeMode(args.timeMode, goal.timeMode);
-    if (objective !== goal.objective) goal.objectiveRevision += 1;
+    if (args.time_limit_minutes != null && args.time_limit_minutes !== '') {
+      const minutes = Number(args.time_limit_minutes);
+      if (!Number.isFinite(minutes) || minutes < 0) throw new Error('goal time_limit_minutes must be 0 or more');
+      timeLimitMs = minutes === 0 ? 0 : parseGoalDuration(minutes * 60_000);
+    } else if (args.timeLimitMs != null) {
+      timeLimitMs = args.timeLimitMs === 0 ? 0 : parseGoalDuration(args.timeLimitMs);
+    } else if (args.duration != null) timeLimitMs = parseGoalDuration(args.duration);
+    if (objective !== goal.objective) goal.objectiveRevision = (Number(goal.objectiveRevision) || 0) + 1;
     goal.objective = objective;
     goal.title = compactSessionTitle(goal.objective);
     if (timeLimitMs !== goal.timeLimitMs) goal.deadlineWarnedMs = NO_DEADLINE_WARNING_MS;
     goal.timeLimitMs = timeLimitMs;
-    goal.timeMode = timeMode;
     if (goal.status === 'complete') activateGoal(goal, at);
     else clearTurnFailures(goal);
     goal.updatedAt = at;
@@ -106,13 +101,19 @@ const GOAL_CONTROL_ACTIONS = {
     return reply(action, timed, `Goal duration · ${durationLabel(limit)}`);
   },
   async complete(ctx, { id, action }) {
-    const goal = await ctx.updateGoal(id, { status: 'complete' }, { user: true });
+    const goal = await ctx.updateGoal(id, { status: 'complete' });
     return reply(action, goal, `Goal complete · ${goal.objective} · ${durationLabel(goal.timeUsedMs)} elapsed`);
   },
-  async dismiss(ctx, { id, goal, at, action }) {
+  async dismiss(ctx, { id, goal, at, action, expectedGoalId }) {
+    // A stalled Goal waits for the user and nothing else retires it: dismissing
+    // it is the stop-and-archive the Stop control confirms.
+    if (goalStalled(goal)) {
+      await ctx.abandonGoal(id, { expectedGoalId, archive: true });
+      return reply(action, null, `Goal dismissed · ${goal.objective}`);
+    }
     // The user's acknowledgement of finished work: the same archive a new
     // prompt applies, so the chrome lets go while the record stays.
-    if (!goalFinished(goal)) throw new Error('only a finished Goal can be dismissed; stop or complete it first');
+    if (!goalFinished(goal)) throw new Error('only a finished or stalled Goal can be dismissed; stop it first');
     if (!goal.archivedAt) {
       goal.archivedAt = at;
       goal.updatedAt = at;
@@ -129,11 +130,33 @@ export async function runGoalControl(ctx, sessionId, rawArgs = {}) {
   else if (rawArgs?.command != null) args = { ...rawArgs, ...parseUserCommand(rawArgs.command) };
   const action = clean(args?.action || 'get').toLowerCase();
   if (action === 'create') {
+    const existing = ctx.readRecord(id).goal;
+    // Replacing a stalled Goal is the user's call: ask once, and let the same
+    // request come back with `replace` once they agree.
+    if (goalStalled(existing) && args.replace !== true) {
+      return {
+        ok: false,
+        action,
+        code: GOAL_REPLACE_REQUIRED,
+        goal: publicGoal(existing, ctx.now()),
+        message:
+          `A ${existing.status} Goal already exists · ${existing.objective}. ` +
+          `Run /goal --replace=${existing.id} followed by the new objective to replace it.`,
+      };
+    }
+    // The confirmation names the Goal the user saw; it runs inside the
+    // mutation queue, so a Goal that changed since refuses instead of retiring.
+    if (args.replace === true && existing) {
+      if (goalStalled(existing) && !clean(args.expectedGoalId)) {
+        throw new Error(`a replace must name the stalled Goal to retire (--replace=${existing.id})`);
+      }
+      if (clean(args.expectedGoalId)) assertExpectedGoal(existing, args.expectedGoalId, 'replace');
+    }
     const goal = await ctx.createGoal(id, {
       objective: args.objective,
       duration: args.duration,
       timeLimitMs: args.timeLimitMs,
-      timeMode: args.timeMode,
+      replace: args.replace === true,
     });
     return reply(action, goal, `Goal active · ${goal.objective} · ${goalTimingLabel(goal)}`);
   }
@@ -153,9 +176,6 @@ export async function runGoalControl(ctx, sessionId, rawArgs = {}) {
   const goal = ctx.requireGoal(id);
   const expectedGoalId = clean(args.expectedGoalId);
   assertExpectedGoal(goal, expectedGoalId, 'update');
-  if (args.revision != null && args.revision !== goal.revision) {
-    throw new Error('Goal changed while editing; reopen the editor before saving');
-  }
   const at = ctx.now();
   if (goal.status === 'stopped' && action !== 'dismiss') {
     throw new Error('a stopped Goal cannot be changed; create a new Goal');

package/src/runtime/agent/orchestrator/runtime-core/goal-deadlines.mjs

@@ -1,4 +1,14 @@
-import { activeElapsedMs, assertSessionId, normalizeDeadlineWarnedMs, stopActiveClock } from './goal-state.mjs';
+import {
+  GOAL_LIVE_HEARTBEAT_MS,
+  activeElapsedMs,
+  assertSessionId,
+  discardSuspendedTime,
+  normalizeDeadlineWarnedMs,
+  stopActiveClock,
+} from './goal-state.mjs';
+
+// Wall time may outrun the monotonic clock by a little without any suspend.
+const MIN_SUSPEND_EVIDENCE_MS = 5_000;
 
 function normalizeDeadlineWarningMs(value) {
   const thresholds = (Array.isArray(value) ? value : [value])
@@ -9,10 +19,52 @@ function normalizeDeadlineWarningMs(value) {
 
 // Timers only observe crossings. Every durable transition joins the same
 // mutation queue as user edits and re-checks the current committed record.
-export function createGoalDeadlines({ now, readRecord, withMutation, commit, onStorageError, deadlineWarningMs }) {
+export function createGoalDeadlines({
+  now,
+  readRecord,
+  withMutation,
+  commit,
+  stampLive,
+  onStorageError,
+  deadlineWarningMs,
+  monotonicNow = null,
+  // libuv's clock (Node's performance.now) stops during suspend on Linux and
+  // macOS (CLOCK_MONOTONIC, mach_absolute_time) but typically keeps counting
+  // on Windows (QueryPerformanceCounter), so there it proves nothing.
+  suspendDetectable = process.platform !== 'win32',
+}) {
   const warningThresholdsMs = normalizeDeadlineWarningMs(deadlineWarningMs);
+  // Session -> wall and monotonic readings at the last moment the Goal was
+  // known to be running. Wall time that outran the monotonic clock since then
+  // is suspend: positive evidence. A stall of an awake process moves both
+  // clocks, so it is never dropped; without evidence time is counted, because
+  // overcounting is safer than a Goal running past its cap.
+  const anchors = new Map();
+  // Only a Goal that is still running keeps an anchor: an inactive one has its
+  // entry retired by armDeadline, and recording it again would leak.
+  const observe = (id, at, goal) => {
+    if (goal?.status !== 'active') return;
+    const mono = suspendDetectable ? monotonicNow?.() : null;
+    if (mono == null) anchors.delete(id);
+    else anchors.set(id, { wall: at, mono });
+  };
+  const suspendedMs = (id, at) => {
+    const anchor = anchors.get(id);
+    if (!anchor) return 0;
+    const mono = monotonicNow?.();
+    // No reading now: this interval has no evidence and is counted. The anchor
+    // goes too, or a later valid reading would discard time already counted.
+    if (mono == null) {
+      anchors.delete(id);
+      return 0;
+    }
+    const suspended = at - anchor.wall - (mono - anchor.mono);
+    return suspended > MIN_SUSPEND_EVIDENCE_MS ? suspended : 0;
+  };
+  const dropSuspended = (id, goal, at) => discardSuspendedTime(goal, at, suspendedMs(id, at));
   const deadlineTimers = new Map();
   const warningTimers = new Map();
+  const heartbeatTimers = new Map();
   const expiryPending = new Set();
   const warningPending = new Set();
   let closed = false;
@@ -30,25 +82,70 @@ export function createGoalDeadlines({ now, readRecord, withMutation, commit, onS
     }
   };
 
+  // The heartbeat has its own lifetime: re-arming the deadline (every snapshot
+  // read does) must not restart its interval, or reads under a minute apart
+  // would keep it from ever firing.
+  const stopHeartbeat = (sessionId) => {
+    const heartbeat = heartbeatTimers.get(sessionId);
+    if (heartbeat) {
+      clearInterval(heartbeat);
+      heartbeatTimers.delete(sessionId);
+    }
+  };
+
+  // An active Goal's clock runs only while a live runtime holds it. The beat
+  // re-stamps the record so a later load can tell how long nothing ran it; a
+  // beat that finds a long silence (the PC slept) drops that stretch from the
+  // open segment and republishes. The stamp alone is a silent write.
+  const beat = (sessionId) => {
+    const id = assertSessionId(sessionId);
+    void withMutation(id, async () => {
+      if (closed) return;
+      const goal = readRecord(id).goal;
+      if (goal?.status !== 'active' || !goal.lastStartedAt) return;
+      const at = now();
+      if (dropSuspended(id, goal, at)) await commit(id, goal);
+      else {
+        goal.liveAt = at;
+        await stampLive(id, goal);
+      }
+      observe(id, at, goal);
+    }).catch(onStorageError);
+  };
+
   const expiredProjection = (goal, at) => {
     if (goal?.status !== 'active' || !(goal.timeLimitMs > 0) || activeElapsedMs(goal, at) < goal.timeLimitMs)
       return false;
     stopActiveClock(goal, at);
     goal.status = 'duration_reached';
-    goal.timeUsedMs = Math.max(goal.timeUsedMs, goal.timeLimitMs);
+    // The cap is what was spent; a late observation must not report more.
+    goal.timeUsedMs = goal.timeLimitMs;
     goal.updatedAt = at;
     return true;
   };
 
+  // Every path that reads an open segment against the clock (expiry, warnings,
+  // the next timer) first drops the suspended stretch, as the heartbeat does;
+  // otherwise a read after the PC slept would charge the sleep to the budget.
+  // `goal` is a working copy. Returns whether it changed.
+  const settleProjection = (id, goal, at) => {
+    const dropped = dropSuspended(id, goal, at);
+    return expiredProjection(goal, at) || dropped;
+  };
+
   const limitIfExpired = (sessionId) => {
     const id = assertSessionId(sessionId);
     const goal = readRecord(id).goal;
-    if (expiredProjection(goal, now()) && !closed && !expiryPending.has(id)) {
+    if (settleProjection(id, goal, now()) && !closed && !expiryPending.has(id)) {
       expiryPending.add(id);
       void withMutation(id, async () => {
         if (closed) return;
         const current = readRecord(id).goal;
-        if (expiredProjection(current, now())) await commit(id, current);
+        const at = now();
+        if (settleProjection(id, current, at)) {
+          await commit(id, current);
+          observe(id, at, current);
+        }
       })
         .catch(onStorageError)
         .finally(() => expiryPending.delete(id));
@@ -78,8 +175,9 @@ export function createGoalDeadlines({ now, readRecord, withMutation, commit, onS
     return delay;
   };
 
-  const warningState = (goal, at) => {
+  const warningState = (id, goal, at) => {
     if (goal?.status !== 'active' || !goal.lastStartedAt || !(Number(goal.timeLimitMs) > 0)) return null;
+    dropSuspended(id, goal, at);
     const remainingMs = Math.max(0, Number(goal.timeLimitMs) - activeElapsedMs(goal, at));
     if (remainingMs <= 0) return null;
     return {
@@ -92,14 +190,14 @@ export function createGoalDeadlines({ now, readRecord, withMutation, commit, onS
   const deliverDeadlineWarning = (sessionId, thresholdMs = 0) => {
     const id = assertSessionId(sessionId);
     if (closed || warningPending.has(id)) return;
-    const pending = warningState(readRecord(id).goal, now());
+    const pending = warningState(id, readRecord(id).goal, now());
     const target = thresholdMs || pending?.crossedMs || 0;
     if (!pending || !target || pending.crossedMs !== target) return;
     warningPending.add(id);
     void withMutation(id, async () => {
       if (closed) return;
       const current = readRecord(id).goal;
-      const state = warningState(current, now());
+      const state = warningState(id, current, now());
       if (!state?.crossedMs || state.crossedMs !== target) return;
       current.deadlineWarnedMs = Math.min(normalizeDeadlineWarnedMs(current.deadlineWarnedMs), target);
       current.warningRevision = Math.max(0, Math.floor(Number(current.warningRevision) || 0)) + 1;
@@ -123,14 +221,26 @@ export function createGoalDeadlines({ now, readRecord, withMutation, commit, onS
     if (closed) return;
     clearDeadline(sessionId);
     const goal = readRecord(sessionId).goal;
+    if (goal?.status === 'active' && goal.lastStartedAt) {
+      if (!anchors.has(sessionId)) observe(sessionId, now(), goal);
+      if (!heartbeatTimers.has(sessionId)) {
+        const timer = setInterval(() => beat(sessionId), GOAL_LIVE_HEARTBEAT_MS);
+        timer.unref?.();
+        heartbeatTimers.set(sessionId, timer);
+      }
+    } else {
+      stopHeartbeat(sessionId);
+      anchors.delete(sessionId);
+    }
     if (goal?.status !== 'active' || !goal.lastStartedAt || !(Number(goal.timeLimitMs) > 0)) return;
     const at = now();
+    dropSuspended(sessionId, goal, at);
     const remainingMs = Math.max(0, goal.timeLimitMs - activeElapsedMs(goal, at));
     if (remainingMs <= 0) {
       queueMicrotask(() => reportingErrors(() => limitIfExpired(sessionId)));
       return;
     }
-    const warnings = warningState(goal, at);
+    const warnings = warningState(sessionId, goal, at);
     if (warnings?.crossedMs) {
       const thresholdMs = warnings.crossedMs;
       queueMicrotask(() => reportingErrors(() => deliverDeadlineWarning(sessionId, thresholdMs)));
@@ -146,7 +256,19 @@ export function createGoalDeadlines({ now, readRecord, withMutation, commit, onS
     }
     const timer = setTimeout(() => {
       deadlineTimers.delete(sessionId);
-      reportingErrors(() => limitIfExpired(sessionId));
+      // A timer that fires after the PC slept must not expire the Goal on
+      // time nobody ran: settle the suspension first, then decide.
+      reportingErrors(() => {
+        void withMutation(sessionId, async () => {
+          if (closed) return;
+          const current = readRecord(sessionId).goal;
+          const at = now();
+          if (current && settleProjection(sessionId, current, at)) {
+            await commit(sessionId, current);
+            observe(sessionId, at, current);
+          }
+        }).catch(onStorageError);
+      });
     }, remainingMs);
     timer.unref?.();
     deadlineTimers.set(sessionId, timer);
@@ -156,14 +278,23 @@ export function createGoalDeadlines({ now, readRecord, withMutation, commit, onS
     armDeadline,
     clearDeadline,
     limitIfExpired,
+    // A write is about to stamp `liveAt`: charge the pending suspend to the
+    // working copy first, so the stamp never hides it, and `refreshAnchor`
+    // starts the next evidence window once the write has landed.
+    settleSuspended: dropSuspended,
+    refreshAnchor: observe,
+    anchorCount: () => anchors.size,
     close() {
       closed = true;
       for (const timer of deadlineTimers.values()) clearTimeout(timer);
       deadlineTimers.clear();
       for (const timer of warningTimers.values()) clearTimeout(timer);
       warningTimers.clear();
+      for (const timer of heartbeatTimers.values()) clearInterval(timer);
+      heartbeatTimers.clear();
       warningPending.clear();
       expiryPending.clear();
+      anchors.clear();
     },
   };
 }