newmark-agent 0.6.4 → 0.6.7

package/dist/core/agent.js

@@ -68,6 +68,8 @@ const pngjs_1 = require("pngjs");
 const modelValidation_1 = require("./modelValidation");
 const modelValidationStore_1 = require("./modelValidationStore");
 const autoRouter_1 = require("./autoRouter");
+const jevDecision_1 = require("./jevDecision");
+const routeDecisionValidator_1 = require("./routeDecisionValidator");
 const agent_context_manager_1 = require("../context/services/agent-context-manager");
 const toolchain_1 = require("../toolchain");
 const agent_runtime_1 = require("../agent-runtime");
@@ -178,7 +180,7 @@ let CORE_SYSTEM_PROMPT = `You are Newmark Agent, a powerful AI coding assistant
 - Be thorough and precise. Verify your work.
 - Use tools appropriately - don't just describe, do it.
 - Deletion safety (intrinsic, non-overridable): file deletion is allowed only ONE file at a time under Agent supervision. Use the delete_file tool with an absolute path for every single-file delete. Never use bash or the terminal to delete files in bulk: recursive deletes (rm -r/-rf, Remove-Item -Recurse, rmdir /s, del /s), wildcard deletes (rm *.log, del *), loop deletes (for/foreach/while + rm), pipe-fed deletes (Get-ChildItem | Remove-Item), find/xargs deletes, and multi-target or multi-statement deletes are hard-blocked by the runtime and will be rejected. To remove a directory, delete its files one by one first, then remove the now-empty directory without a recursive flag.
-- For desktop Computer Use requests, follow observe -> decide -> act -> observe. Start visible takeover with computer_use takeover_start before multi-step desktop control and stop it when finished. Prefer app-scoped actions through app_list/app_observe/app_* when controlling one taskbar application, because this preserves human collaboration around other windows. Prefer target_id from the latest high-priority semantic UI objects, otherwise precise coordinates from the latest observation. Use vision plus UI controls together when the selected model has vision input. Avoid destructive UI actions unless the user asked for them, and do not claim YOLO/OCR perception unless an actual detector/OCR result is present.
+- For desktop Computer Use requests, follow observe -> decide -> act -> observe. For passive waits, prefer one observe call with sparse_wait_ms (up to 5000) over repeated immediate full observations; it still returns a fresh full screenshot/UIA whether signaled or timed out, and no signal is not proof of no change. Start visible takeover with computer_use takeover_start before multi-step desktop control and stop it when finished. Prefer app-scoped actions through app_list/app_observe/app_* when controlling one taskbar application, because this preserves human collaboration around other windows. Prefer target_id from the latest high-priority semantic UI objects, otherwise precise coordinates from the latest observation. Use vision plus UI controls together when the selected model has vision input. Avoid destructive UI actions unless the user asked for them, and do not claim YOLO/OCR perception unless an actual detector/OCR result is present.
 - For browser buttons and scanned document pages, the strict recognition sequence is text layer/DOM -> screenshot to a validated vision model -> local OCR. Do not skip directly to OCR. If OCR is used, treat it as approximate evidence and repair only what surrounding context supports.
 - Multiple tool calls emitted in one provider turn run concurrently. Treat their returned records as one barrier: continue reasoning only after every call in that batch has returned either a successful receipt or a failure receipt.
 - terminal_takeover start creates or reuses a persistent session. Its successful start receipt completes that Build step immediately; continue with write/read or other work without waiting for detach, stop, shell exit, or terminal closure.
@@ -275,6 +277,8 @@ class Agent {
     // Bounded caller-owned peer slots retain protocol compatibility learning
     // between mailbox jobs. They never retain the child Agent or go to disk.
     peerProviderCaches = new Map();
+    /** Reuses the provider connection for current-model JEV calls without sharing conversation build state. */
+    jevProviderCache = {};
     awaitingAgentKernelRuntime = false;
     pendingAgentKernelQueue = [];
     linkedPlanAccess;
@@ -294,7 +298,7 @@ class Agent {
     finalizingWorkRunId = '';
     agentRunService = null;
     agentRunByWorkRunId = new Map();
-    autoRouter;
+    routeController;
     resolvedDeployment = null;
     fixedDeployment = null;
     preferredConversationModelSelection = null;
@@ -306,11 +310,21 @@ class Agent {
     lastRouteRetryDelayMs = 0;
     routeAttemptStartedAt = 0;
     providerBalanceBlockedUntilByDeployment = new Map();
-    explicitlyRatedRoutes = new Map();
     conversationStateCache = new Map();
     conversationStateCacheFingerprint = new Map();
+    conversationStateWrittenFingerprint = new Map();
+    conversationShardFingerprint = new Map();
+    hydratedShardEntries = new WeakSet();
+    /**
+     * Revision of the durable queue snapshot this runtime is working from. The
+     * merge only accepts a writer's queue when that writer has seen the persisted
+     * revision, so an outdated in-memory snapshot can neither drop queued work
+     * nor resurrect an entry that was already consumed or cleared.
+     */
+    continuationRevision = 0;
     conversationStateFlushTimers = new Map();
     conversationStateDirty = new Map();
+    conversationStateLastWriteAt = new Map();
     systemPromptCache = null;
     toolDefinitionCache = new Map();
     modelValidationPromise = null;
@@ -381,8 +395,7 @@ class Agent {
                 /* crash recovery is best-effort at startup */
             }
         }
-        this.autoRouter = new autoRouter_1.AutoRouter({ policyVersion: 'newmark-auto-v1' });
-        this.loadLearnedRouteFeedback();
+        this.routeController = new autoRouter_1.RouteExecutionController({ policyVersion: autoRouter_1.ROUTE_POLICY_VERSION });
         if (this.isSubagentRuntime || this.agentOnly) {
             this.config.set('workspace', 'auto_create_timestamp_workspace', false);
         }
@@ -857,7 +870,6 @@ class Agent {
             }
             return;
         }
-        const previousAuto = this.model === 'auto' ? this.resolvedDeployment : null;
         const qualified = parseDeploymentSelectionValue(requested);
         const legacyQualified = requested.includes('/')
             ? this.config.allModels().filter(model => `${model.provider_id}/${model.name}` === requested || `${model.provider}/${model.name}` === requested)
@@ -871,11 +883,8 @@ class Agent {
         this.pendingAutoAttempts = [];
         if (current?.provider_id)
             this.config.set('models', 'auto_switch_anchor_provider', current.provider_id);
-        if (previousAuto && current) {
-            const taskClass = this.lastRouteDecision?.taskClasses[0] || 'chat';
-            this.recordRouteFeedbackFor(previousAuto, taskClass, -1, 'manual_switch');
-            this.recordRouteFeedbackFor(this.deploymentRef(current), taskClass, 1, 'manual_switch');
-        }
+        // A manual model switch is explicit user control. Auto Router v2 records
+        // no feedback for it: switching models must never train future Auto routes.
         this.lastRouteDecision = null;
         this.routeAttemptStartedAt = 0;
         this.routeStreamCommitted = false;
@@ -1052,7 +1061,7 @@ class Agent {
     }
     resetAutoRoute() {
         if (this.routeTransactionId)
-            this.autoRouter.endTransaction(this.routeTransactionId);
+            this.routeController.endTransaction(this.routeTransactionId);
         this.resolvedDeployment = null;
         this.lastRouteDecision = null;
         this.pendingAutoAttempts = [];
@@ -1095,7 +1104,7 @@ class Agent {
         const deployment = this.activeDeployment();
         if (!deployment)
             return;
-        this.autoRouter.recordEndpointSuccess(deployment, latencyMs, throughput);
+        this.routeController.recordEndpointSuccess(deployment, latencyMs, throughput);
         if (this.lastRouteDecision) {
             const attempt = [...this.lastRouteDecision.attempts].reverse().find(item => deploymentIdentity(item.deployment) === deploymentIdentity(deployment));
             if (attempt) {
@@ -1114,7 +1123,7 @@ class Agent {
         const deployment = this.activeDeployment();
         if (!deployment)
             return;
-        this.autoRouter.recordToolOutcome(deployment, valid);
+        this.routeController.recordToolOutcome(deployment, valid);
     }
     updateProviders(value) {
         const before = this.config.providers();
@@ -1135,7 +1144,7 @@ class Agent {
                 if (!provider)
                     continue;
                 for (const model of provider.models || []) {
-                    this.autoRouter.resetEndpointAfterConfigChange({
+                    this.routeController.resetEndpointAfterConfigChange({
                         providerId: provider.id,
                         modelId: model.name,
                         logicalModelGroupId: model.logical_model_group_id || undefined,
@@ -1146,76 +1155,59 @@ class Agent {
         if (changed)
             this.resetAutoRoute();
     }
-    clearLearnedModelPreferences() {
-        this.autoRouter.clearLearnedPreferences();
-        const target = path.join(this.rootPath, 'routing', 'feedback.jsonl');
-        try {
-            fs.rmSync(target, { force: true });
-        }
-        catch { }
-    }
-    rateActiveAutoRoute(score, expectedRouteId = '') {
-        const normalizedScore = Number(score);
-        if (normalizedScore !== -1 && normalizedScore !== 1) {
-            return { ok: false, reason: 'invalid_score' };
-        }
-        const decision = this.lastRouteDecision;
-        const deployment = this.activeDeployment();
-        if (this.model !== 'auto'
-            || decision?.requestedSelection.kind !== 'auto'
-            || !decision.routeId
-            || !decision.resolvedDeployment
-            || !deployment) {
-            return { ok: false, reason: 'no_active_auto_route' };
-        }
-        const requestedRouteId = String(expectedRouteId || '').trim();
-        if (requestedRouteId && requestedRouteId !== decision.routeId) {
-            return { ok: false, routeId: decision.routeId, reason: 'stale_route' };
-        }
-        const previousScore = this.explicitlyRatedRoutes.get(decision.routeId);
-        if (previousScore !== undefined) {
-            return { ok: false, score: previousScore, routeId: decision.routeId, reason: 'already_rated' };
-        }
-        const taskClasses = [...new Set(decision.taskClasses)];
-        for (const taskClass of taskClasses) {
-            this.recordRouteFeedbackFor(deployment, taskClass, normalizedScore, 'explicit_rating');
-        }
-        this.recordRouteQualityObservation(deployment, taskClasses, normalizedScore > 0);
-        this.explicitlyRatedRoutes.set(decision.routeId, normalizedScore);
-        while (this.explicitlyRatedRoutes.size > 1_000) {
-            const oldest = this.explicitlyRatedRoutes.keys().next().value;
-            if (!oldest)
-                break;
-            this.explicitlyRatedRoutes.delete(oldest);
-        }
-        return { ok: true, score: normalizedScore, routeId: decision.routeId };
+    /**
+     * Auto master switch. Every automatic model decision in this runtime is
+     * gated on it: when it is off the Agent neither routes nor edits the current
+     * model decision settings, and no code path may move the active model on its own.
+     */
+    autoDecisionEnabled() {
+        return this.config.autoSwitchEnabled();
     }
-    recordObjectiveRouteResult(success) {
-        const deployment = this.activeDeployment();
-        if (!deployment || !this.lastRouteDecision)
-            return;
-        const taskClasses = [...new Set(this.lastRouteDecision.taskClasses)];
-        this.recordRouteQualityObservation(deployment, taskClasses, success);
-        for (const taskClass of taskClasses) {
-            if (success)
-                this.recordRouteFeedbackFor(deployment, taskClass, 1, 'objective_success');
-        }
+    /** Current-model JEV settings exposed to GUI / TUI / CLI editors. */
+    jevDecisionModelState() {
+        const autoEnabled = this.autoDecisionEnabled();
+        const timeout = Number(this.config.get('models', 'jev_timeout_ms'));
+        return {
+            autoEnabled,
+            locked: !autoEnabled,
+            ...(autoEnabled ? {} : { lockReason: 'auto_disabled' }),
+            enabled: this.config.get('models', 'jev_enabled') !== false,
+            decisionModel: 'current_eligible_model',
+            thinkingMode: 'off',
+            outputFormat: 'strict_json_schema',
+            timeoutMs: Number.isFinite(timeout) && timeout > 0 ? Math.round(timeout) : jevDecision_1.DEFAULT_JEV_TIMEOUT_MS,
+        };
     }
-    recordRouteQualityObservation(deployment, taskClasses, success) {
-        const model = this.config.findDeployment(deployment);
-        if (!model)
-            return;
-        const quality = Object.assign({}, model.quality_by_task);
-        for (const taskClass of new Set(taskClasses)) {
-            const previous = quality[taskClass] || { successes: 0, attempts: 0 };
-            quality[taskClass] = {
-                attempts: Math.max(0, previous.attempts) + 1,
-                successes: Math.max(0, previous.successes) + (success ? 1 : 0),
-            };
-        }
-        if (!this.config.updateModelByDeployment(deployment.providerId, deployment.modelId, { quality_by_task: quality }))
-            return;
+    /**
+     * Edit current-model Auto decision settings.
+     *
+     * Refuses every write while Auto is off (`auto_disabled`): with automatic
+     * decision-making disabled, not even the decision-model configuration may
+     * change — that is what "Auto off never moves a model" means at the editor
+     * boundary. Invalid values are rejected without touching the stored config.
+     */
+    updateJevDecisionModel(patch = {}) {
+        if (!this.autoDecisionEnabled()) {
+            return { ok: false, reason: 'auto_disabled', state: this.jevDecisionModelState() };
+        }
+        const current = this.jevDecisionModelState();
+        const next = { ...current };
+        const reject = () => ({ ok: false, reason: 'invalid_value', state: this.jevDecisionModelState() });
+        const editableKeys = new Set(['enabled', 'timeoutMs']);
+        if (Object.keys(patch).some(key => !editableKeys.has(key)))
+            return reject();
+        if (patch.enabled !== undefined)
+            next.enabled = patch.enabled === true;
+        if (patch.timeoutMs !== undefined) {
+            const timeout = Number(patch.timeoutMs);
+            if (!Number.isFinite(timeout) || timeout < 100 || timeout > 30_000)
+                return reject();
+            next.timeoutMs = Math.round(timeout);
+        }
+        this.config.set('models', 'jev_enabled', next.enabled);
+        this.config.set('models', 'jev_timeout_ms', next.timeoutMs);
         this.config.save();
+        return { ok: true, state: this.jevDecisionModelState() };
     }
     workspaceConversationKey() {
         const ws = this.workspace.current;
@@ -1228,6 +1220,158 @@ class Agent {
             return null;
         return path.join(ws.path, 'conversations', 'state.json');
     }
+    /**
+     * Heavy conversation payload that lives in a per-conversation shard file
+     * instead of the workspace index document. Everything else (title, pinning,
+     * order, draft, mode, goal, runtime owner, counters) stays in the index so
+     * listing, sorting and cross-process merge never need to parse a transcript.
+     */
+    static CONVERSATION_SHARD_FIELDS = [
+        'chatMessages', 'history', 'workRuns', 'continuations',
+        'compressionCache', 'branches', 'tree', 'branchMailbox',
+    ];
+    workspaceConversationShardDir(ws = this.workspace.current) {
+        const store = this.workspaceConversationStorePath(ws);
+        if (!store)
+            return null;
+        return path.join(path.dirname(store), 'shards');
+    }
+    conversationShardFileName(key) {
+        const safe = String(key).replace(/[^a-zA-Z0-9._-]+/g, '_').slice(0, 180);
+        const digest = crypto.createHash('sha1').update(String(key)).digest('hex').slice(0, 12);
+        return `${safe}.${digest}.json`;
+    }
+    conversationShardPath(key, ws = this.workspace.current) {
+        const dir = this.workspaceConversationShardDir(ws);
+        if (!dir)
+            return null;
+        return path.join(dir, this.conversationShardFileName(key));
+    }
+    /**
+     * Hydrate one conversation entry from its shard on first access. The heavy
+     * fields are non-enumerable so `{ ...entry }` (and therefore the index
+     * document written back to disk) never pulls a transcript into memory, while
+     * every existing reader that asks for `entry.chatMessages` / `entry.history`
+     * keeps working unchanged.
+     */
+    attachConversationShard(entry, shardFile, key) {
+        const cache = { loaded: false, value: null };
+        const load = () => {
+            if (cache.loaded)
+                return cache.value;
+            cache.loaded = true;
+            this.hydratedShardEntries.add(entry);
+            try {
+                const raw = fs.readFileSync(shardFile, 'utf-8').replace(/^\uFEFF/, '');
+                const parsed = JSON.parse(raw);
+                cache.value = parsed && typeof parsed === 'object' ? parsed : null;
+            }
+            catch {
+                cache.value = null;
+            }
+            return cache.value;
+        };
+        for (const field of Agent.CONVERSATION_SHARD_FIELDS) {
+            Object.defineProperty(entry, field, {
+                enumerable: false,
+                configurable: true,
+                get: () => {
+                    const shard = load();
+                    return shard ? shard[field] : undefined;
+                },
+                set: (value) => {
+                    this.hydratedShardEntries.add(entry);
+                    const shard = { ...(cache.value || {}) };
+                    shard[field] = value;
+                    cache.value = shard;
+                    cache.loaded = true;
+                },
+            });
+        }
+        void key;
+    }
+    /**
+     * Heavy payload carried in memory by this entry, or `null` when the entry is
+     * a shard-backed index record whose heavy fields were never touched. That
+     * distinction is what keeps unrelated conversations off the write path.
+     */
+    conversationShardSnapshot(entry) {
+        // Ownership rule: a *live* entry carries the heavy fields as own enumerable
+        // properties; an index record read back from disk exposes them as
+        // non-enumerable accessors that hydrate from the shard on demand. Only a
+        // record that was actually hydrated (its accessors fired) counts as owning
+        // its payload — keying on a `shard` marker instead would misclassify the
+        // live entry, because it is built by spreading the previous index entry.
+        const hydrated = this.hydratedShardEntries.has(entry);
+        const snapshot = {};
+        let any = false;
+        for (const field of Agent.CONVERSATION_SHARD_FIELDS) {
+            const descriptor = Object.getOwnPropertyDescriptor(entry, field);
+            if (!descriptor)
+                continue;
+            if (!descriptor.enumerable && !hydrated)
+                continue;
+            const value = descriptor.get ? descriptor.get.call(entry) : descriptor.value;
+            if (value === undefined)
+                continue;
+            snapshot[field] = value;
+            any = true;
+        }
+        return any ? snapshot : null;
+    }
+    /**
+     * Force one shard-backed entry into memory. Used only on the rare recovery
+     * paths that must compare against a payload written by another runtime.
+     */
+    hydrateConversationEntry(entry) {
+        if (typeof entry.shard !== 'string' || !entry.shard)
+            return;
+        this.hydratedShardEntries.add(entry);
+        for (const field of Agent.CONVERSATION_SHARD_FIELDS) {
+            const value = entry[field];
+            if (value !== undefined)
+                entry[field] = value;
+        }
+    }
+    /**
+     * Durable queue merge.
+     *
+     * Queue entries are the user's pending work, so a runtime that never saw an
+     * entry must not delete it, while an entry this runtime actually consumed
+     * must not be resurrected. Identity-based union minus exactly the consumed
+     * ids gives both guarantees without needing a global revision clock.
+     */
+    mergeConversationContinuations(incoming, existingCount, existingShardBacked, existingEntry, incomingRevision, existingRevision) {
+        // A writer that has seen the persisted revision owns the queue (including
+        // deliberate clearing/consumption). Anything older keeps what is stored.
+        if (incomingRevision >= existingRevision)
+            return this.normalizeContinuations(incoming);
+        if (existingShardBacked)
+            this.hydrateConversationEntry(existingEntry);
+        const existing = existingEntry.continuations || [];
+        void existingCount;
+        return this.normalizeContinuations(existing.length ? existing : incoming);
+    }
+    /** Index-document form of a conversation entry: metadata plus a shard pointer. */
+    conversationIndexEntryForDisk(entry, shardFileName, shardBytes, counts) {
+        const index = {};
+        for (const [field, value] of Object.entries(entry))
+            index[field] = value;
+        for (const field of Agent.CONVERSATION_SHARD_FIELDS)
+            delete index[field];
+        index.messageCount = counts.messageCount;
+        index.historyCount = counts.historyCount;
+        index.workRunCount = counts.workRunCount;
+        index.hasTree = counts.hasTree;
+        index.hasBranches = counts.hasBranches;
+        index.continuationCount = counts.continuationCount;
+        index.continuationRevision = counts.continuationRevision;
+        if (shardFileName) {
+            index.shard = shardFileName;
+            index.shardBytes = shardBytes;
+        }
+        return index;
+    }
     workspaceConversationStateKey(conversationId = this.activeConversationId) {
         return this.workspaceConversationStateKeyFor(conversationId, this.workspace.current);
     }
@@ -1537,6 +1681,26 @@ class Agent {
             tree,
         };
     }
+    /**
+     * Bound the live Build ledger.
+     *
+     * `normalizeWorkRuns()` already windows the persisted/served ledger to 120
+     * runs, but the live `this.workRuns` array kept every Build block of the
+     * conversation (measured: 307 runs / 4.6 MiB after 300 turns). The renderer
+     * only ever shows the newest window, so older terminal runs can be dropped
+     * from memory while the conversation continues.
+     */
+    pruneLiveWorkRuns() {
+        const window = 120;
+        if (this.workRuns.length <= window)
+            return;
+        const running = this.workRuns.filter(run => run.status === 'running');
+        const keep = new Set(running.map(run => run.runId));
+        const byRecency = [...this.workRuns].sort((a, b) => String(a.startedAt || '').localeCompare(String(b.startedAt || '')));
+        for (const run of byRecency.slice(-window))
+            keep.add(run.runId);
+        this.workRuns = this.workRuns.filter(run => keep.has(run.runId));
+    }
     normalizeWorkRuns(runs) {
         if (!Array.isArray(runs))
             return [];
@@ -1815,6 +1979,7 @@ class Agent {
         return true;
     }
     beginConversationWorkRun(runId, target = this.currentConversationTarget(), startedAt = this.nowIso(), managed = false, runtimeKey) {
+        this.pruneLiveWorkRuns();
         const cleanRunId = String(runId || crypto.randomUUID()).trim().slice(0, 200);
         const existing = this.workRuns.find(run => run.runId === cleanRunId);
         if (existing) {
@@ -2499,8 +2664,11 @@ class Agent {
         }
         if (event.type === 'start')
             this.saveWorkspaceConversationState(false);
+        // Terminal events are coalesced on purpose: `Agent.process()` performs the
+        // synchronous save right after this sequence, so persisting here as well
+        // only rewrote the whole conversation again for the same turn.
         if (event.type === 'done' || event.type === 'error')
-            this.saveWorkspaceConversationState(true);
+            this.saveWorkspaceConversationState(false);
         if (activeRun && this.finalizingWorkRunId !== activeRun.runId
             && (event.type === 'done' || event.type === 'error') && activeRun.status !== 'running') {
             const terminalStatus = activeRun.status;
@@ -2617,8 +2785,10 @@ class Agent {
         const before = this.continuations.length;
         this.continuations = this.continuations.filter(item => item.queueMode !== 'followUp'
             || !matches(item.content, item.hiddenUserInput === true, item.clientMessageId));
-        if (this.continuations.length !== before)
+        if (this.continuations.length !== before) {
+            this.continuationRevision += 1;
             this.saveWorkspaceConversationState(true);
+        }
         for (const subscriber of this.rootInboxRetiredSubscribers)
             subscriber(ids);
         return ids;
@@ -2705,6 +2875,7 @@ class Agent {
                 createdAt: item.createdAt || new Date().toISOString(),
             }))]);
         this.continuations = combined;
+        this.continuationRevision += 1;
         this.saveWorkspaceConversationState(true);
         return combined.map(item => ({
             ...item,
@@ -2719,6 +2890,7 @@ class Agent {
         if (index < 0)
             return false;
         this.continuations.splice(index, 1);
+        this.continuationRevision += 1;
         this.saveWorkspaceConversationState(true);
         return true;
     }
@@ -2808,7 +2980,15 @@ class Agent {
                 state.version = Math.max(1, Number(state.version || 1));
                 state.conversations = state.conversations || {};
                 let migrated = false;
-                for (const entry of Object.values(state.conversations)) {
+                const shardDir = this.workspaceConversationShardDir(ws);
+                for (const [key, entry] of Object.entries(state.conversations)) {
+                    if (entry.shard) {
+                        // Index record: attach lazy accessors instead of reading the shard.
+                        const shardFile = shardDir ? path.join(shardDir, String(entry.shard)) : '';
+                        if (shardFile)
+                            this.attachConversationShard(entry, shardFile, key);
+                        continue;
+                    }
                     if (!entry.tree && entry.branches?.length) {
                         this.normalizeConversationTree(entry);
                         entry.branches = undefined;
@@ -2828,25 +3008,87 @@ class Agent {
         }
         return {};
     }
+    /** Durable replacement-style text write (temp file + fsync + rename). */
+    writeAtomicTextFile(file, content) {
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        const temp = `${file}.${process.pid}.${crypto.randomUUID()}.tmp`;
+        try {
+            const handle = fs.openSync(temp, 'w');
+            try {
+                fs.writeFileSync(handle, content, 'utf-8');
+                fs.fsyncSync(handle);
+            }
+            finally {
+                fs.closeSync(handle);
+            }
+            let lastError = null;
+            for (let attempt = 0; attempt < 12; attempt += 1) {
+                try {
+                    fs.renameSync(temp, file);
+                    return;
+                }
+                catch (error) {
+                    lastError = error;
+                    const code = error && typeof error === 'object' && 'code' in error ? String(error.code || '') : '';
+                    if (!['EPERM', 'EACCES', 'EBUSY'].includes(code))
+                        break;
+                    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10 * (attempt + 1));
+                }
+            }
+            throw lastError;
+        }
+        finally {
+            try {
+                fs.unlinkSync(temp);
+            }
+            catch { }
+        }
+    }
     writeStoredConversationState(state, ws = this.workspace.current, deletedKeys = []) {
         this.writeStoredConversationStateNow(state, ws, deletedKeys);
     }
-    scheduleStoredConversationState(state, ws = this.workspace.current, delayMs = 80) {
+    /**
+     * Coalesced conversation-state write.
+     *
+     * Mid-turn persistence used to rewrite the whole workspace document
+     * synchronously on every kernel event (measured: 5.33 full rewrites per turn
+     * with no tools). The document grows with the conversation, so that cost grew
+     * with the turn count. This path keeps durability at turn boundaries (the
+     * terminal save stays synchronous and cancels any pending timer) while
+     * throttling intermediate saves: the latest snapshot wins, and bursts inside
+     * one throttle window collapse into a single write.
+     */
+    scheduleStoredConversationState(state, ws = this.workspace.current, minIntervalMs = 80) {
         const file = this.workspaceConversationStorePath(ws);
         if (!file)
             return;
-        this.conversationStateDirty.set(file, { state, ws });
-        const current = this.conversationStateFlushTimers.get(file);
-        if (current)
-            clearTimeout(current);
-        this.conversationStateFlushTimers.set(file, setTimeout(() => {
+        this.conversationStateDirty.set(file, { state, ws, at: Date.now() });
+        // A write is already queued: keep it and let it carry the newest snapshot
+        // instead of pushing the deadline out (debounce) on every event.
+        if (this.conversationStateFlushTimers.has(file))
+            return;
+        const elapsed = Date.now() - (this.conversationStateLastWriteAt.get(file) || 0);
+        const wait = Math.max(0, minIntervalMs - elapsed);
+        const timer = setTimeout(() => {
             this.conversationStateFlushTimers.delete(file);
             const pending = this.conversationStateDirty.get(file);
             if (!pending)
                 return;
             this.conversationStateDirty.delete(file);
-            this.writeStoredConversationStateNow(pending.state, pending.ws);
-        }, Math.max(0, delayMs)));
+            try {
+                this.writeStoredConversationStateNow(pending.state, pending.ws);
+            }
+            catch (error) {
+                // A deferred write must never take the process down: keep the snapshot
+                // pending so the next save or the exit flush retries it.
+                this.conversationStateDirty.set(file, pending);
+                if (process.env.NEWMARK_PROVIDER_DIAGNOSTICS === '1')
+                    console.error(`[NewmarkState] deferred conversation-state write failed: ${String(error)}`);
+            }
+        }, wait);
+        if (typeof timer.unref === 'function')
+            timer.unref();
+        this.conversationStateFlushTimers.set(file, timer);
     }
     flushWorkspaceConversationState() {
         const file = this.workspaceConversationStorePath();
@@ -2929,6 +3171,16 @@ class Agent {
     writeStoredConversationStateNow(state, ws = this.workspace.current, deletedKeys = []) {
         const file = this.workspaceConversationStorePath(ws);
         if (file) {
+            // A queued coalesced snapshot may hold changes for *other* conversations
+            // (for example provider usage recorded just before switching away). Fold
+            // those in before cancelling it so a synchronous save can never drop them.
+            const pending = this.conversationStateDirty.get(file);
+            if (pending) {
+                state = {
+                    ...state,
+                    conversations: { ...(pending.state.conversations || {}), ...(state.conversations || {}) },
+                };
+            }
             const pendingTimer = this.conversationStateFlushTimers.get(file);
             if (pendingTimer)
                 clearTimeout(pendingTimer);
@@ -2950,29 +3202,139 @@ class Agent {
                 const existingUpdatedAt = Date.parse(existing.updatedAt || '') || 0;
                 const preferred = incomingUpdatedAt >= existingUpdatedAt ? { ...existing, ...incoming } : { ...incoming, ...existing };
                 const branchPageReplacement = !!incoming.branchReset || !!incoming.tree || !!incoming.branches?.length;
-                const incomingTranscriptEmpty = !(incoming.chatMessages || []).length && !(incoming.history || []).length;
-                const existingTranscriptPresent = !!(existing.chatMessages || []).length || !!(existing.history || []).length;
-                if (incomingTranscriptEmpty && existingTranscriptPresent && !branchPageReplacement) {
-                    preferred.chatMessages = existing.chatMessages;
-                    preferred.history = existing.history;
+                // Only the side that actually carries a payload may decide the heavy
+                // fields. A shard-backed index entry that this process never touched
+                // must not be hydrated just to merge metadata.
+                const incomingEntry = incoming;
+                const existingEntry = existing;
+                const incomingShard = this.conversationShardSnapshot(incomingEntry);
+                const count = (value) => (Array.isArray(value) ? value.length : 0);
+                const existingMessages = Number(existing.messageCount) || count(existingEntry.chatMessages);
+                const existingHistory = Number(existing.historyCount) || count(existingEntry.history);
+                const incomingMessages = incomingShard ? count(incomingShard.chatMessages) : Number(incoming.messageCount) || 0;
+                const incomingHistory = incomingShard ? count(incomingShard.history) : Number(incoming.historyCount) || 0;
+                const incomingTranscriptEmpty = incomingMessages === 0 && incomingHistory === 0;
+                // Legacy guard: an empty in-memory snapshot must never clobber a stored
+                // transcript (mirrors, cold reloads and legacy callers can carry an
+                // entry without its messages).
+                const keepsExistingPayload = incomingTranscriptEmpty
+                    && (existingMessages > 0 || existingHistory > 0)
+                    && !branchPageReplacement;
+                if (!incomingShard || keepsExistingPayload) {
+                    // Metadata-only update: keep the existing heavy payload and pointer.
+                    preferred.messageCount = existingMessages || Number(preferred.messageCount) || 0;
+                    preferred.historyCount = existingHistory || Number(preferred.historyCount) || 0;
+                    preferred.workRunCount = Number(existing.workRunCount) || Number(preferred.workRunCount) || 0;
+                    if (typeof existing.shard === 'string' && existing.shard) {
+                        preferred.shard = existing.shard;
+                        preferred.shardBytes = Number(existing.shardBytes) || Number(preferred.shardBytes) || 0;
+                    }
+                    // `preferred` is a shallow metadata copy: the lazy shard accessors are
+                    // non-enumerable and therefore absent from it. Re-attach them so the
+                    // cached state keeps exposing this conversation's transcript instead
+                    // of looking like an empty conversation to later readers.
+                    if (typeof preferred.shard === 'string' && preferred.shard) {
+                        const shardDir = this.workspaceConversationShardDir(ws);
+                        if (shardDir) {
+                            this.attachConversationShard(preferred, path.join(shardDir, String(preferred.shard)), key);
+                        }
+                    }
+                    // Even a metadata-only writer can carry a stale WorkRun ledger. Load
+                    // the existing shard, then reconcile by run id and event sequence;
+                    // the other heavy fields still come from that same persisted shard.
+                    // Explicit branch-page replacement is the only path that replaces
+                    // runs without merging. A completed snapshot wins over an older
+                    // running copy, while explicit resume emits a newer sequence.
+                    const incomingRuns = Array.isArray(incoming.workRuns) ? incoming.workRuns : null;
+                    if (branchPageReplacement) {
+                        preferred.workRuns = this.normalizeWorkRuns(incomingRuns || []);
+                    }
+                    else if (incomingRuns) {
+                        const existingShardBacked = typeof preferred.shard === 'string' && !!preferred.shard;
+                        let previousRuns = [];
+                        if (existingShardBacked) {
+                            const preferredEntry = preferred;
+                            this.hydrateConversationEntry(preferredEntry);
+                            previousRuns = preferred.workRuns || [];
+                        }
+                        else {
+                            previousRuns = existing.workRuns || [];
+                        }
+                        preferred.workRuns = this.normalizeWorkRuns([...previousRuns, ...incomingRuns]);
+                    }
+                    merged[key] = preferred;
+                    continue;
                 }
+                // This process owns a payload for this conversation. Which side wins is
+                // decided per field exactly like the pre-shard merge did:
+                //   - `updatedAt` orders whole entries (a stale in-memory snapshot must
+                //     never revert a newer persisted transcript/queue);
+                //   - fields the caller does not produce at all (`tree`/`branches` come
+                //     from branch transactions, never from saveWorkspaceConversationState)
+                //     always survive from the stored payload;
+                //   - a branch page replacement still takes the incoming side verbatim.
+                const preferIncoming = incomingUpdatedAt >= existingUpdatedAt;
+                const existingShardBacked = Object.prototype.hasOwnProperty.call(existing, 'shard');
+                const needsExistingPayload = existingShardBacked && (!preferIncoming
+                    || (!!existing.hasTree && incomingShard.tree === undefined)
+                    || (!!existing.hasBranches && incomingShard.branches === undefined));
+                const priorPayload = needsExistingPayload
+                    ? (this.hydrateConversationEntry(existingEntry), existingEntry)
+                    : null;
+                const winningHeavy = (field) => {
+                    const existingValue = priorPayload ? priorPayload[field] : undefined;
+                    const incomingValue = incomingShard[field];
+                    if (preferIncoming)
+                        return incomingValue !== undefined ? incomingValue : existingValue;
+                    return existingValue !== undefined ? existingValue : incomingValue;
+                };
                 const incomingPlanRevision = Math.max(0, Number(incoming.linkedPlan?.revision || 0));
                 const existingPlanRevision = Math.max(0, Number(existing.linkedPlan?.revision || 0));
                 preferred.linkedPlan = incomingPlanRevision >= existingPlanRevision ? incoming.linkedPlan : existing.linkedPlan;
                 const incomingSequence = Math.max(0, Number(incoming.subagentState?.nextSequence || 0));
                 const existingSequence = Math.max(0, Number(existing.subagentState?.nextSequence || 0));
                 preferred.subagentState = incomingSequence >= existingSequence ? incoming.subagentState : existing.subagentState;
-                preferred.chatMessages = branchPageReplacement ? [...(incoming.chatMessages || [])] : preferred.chatMessages;
-                preferred.history = branchPageReplacement ? [...(incoming.history || [])] : preferred.history;
+                preferred.chatMessages = branchPageReplacement
+                    ? [...(incomingShard.chatMessages || [])]
+                    : winningHeavy('chatMessages') || [];
+                preferred.history = branchPageReplacement
+                    ? [...(incomingShard.history || [])]
+                    : winningHeavy('history') || [];
+                // WorkRun ledgers can diverge across isolated runtimes while keeping
+                // the same number of runs (for example, a stale `running` snapshot
+                // after another runtime durably completed that run). Always reconcile
+                // the persisted ledger with the incoming one; normalizeWorkRuns merges
+                // duplicate run ids by event sequence and terminal rank. Explicit
+                // resume emits a newer event sequence, so it still reopens the run.
+                const incomingRuns = incomingShard.workRuns || [];
+                const previousRuns = existingShardBacked && !branchPageReplacement
+                    ? (this.hydrateConversationEntry(existingEntry), existingEntry.workRuns || [])
+                    : [];
                 preferred.workRuns = branchPageReplacement
-                    ? this.normalizeWorkRuns(incoming.workRuns)
-                    : this.normalizeWorkRuns([...(existing.workRuns || []), ...(incoming.workRuns || [])]);
-                preferred.continuations = branchPageReplacement ? this.normalizeContinuations(incoming.continuations) : preferred.continuations;
-                preferred.branches = branchPageReplacement ? [...(incoming.branches || [])] : preferred.branches;
+                    ? this.normalizeWorkRuns(incomingRuns)
+                    : this.normalizeWorkRuns([...previousRuns, ...incomingRuns]);
+                preferred.continuations = branchPageReplacement
+                    ? this.normalizeContinuations(incomingShard.continuations || [])
+                    : this.mergeConversationContinuations(incomingShard.continuations || [], Number(existing.continuationCount) || 0, existingShardBacked, existingEntry, Number(incoming.continuationRevision) || 0, Number(existing.continuationRevision) || 0);
+                if (branchPageReplacement)
+                    preferred.branches = [...(incomingShard.branches || [])];
+                else if (winningHeavy('branches') !== undefined)
+                    preferred.branches = winningHeavy('branches');
                 preferred.activeBranchId = branchPageReplacement ? String(incoming.activeBranchId || '') : preferred.activeBranchId;
                 preferred.activeBranchGroupId = branchPageReplacement ? String(incoming.activeBranchGroupId || '') : preferred.activeBranchGroupId;
-                preferred.tree = branchPageReplacement ? incoming.tree : preferred.tree;
+                preferred.tree = winningHeavy('tree') || preferred.tree;
                 preferred.branchReset = branchPageReplacement;
+                if (priorPayload) {
+                    for (const field of Agent.CONVERSATION_SHARD_FIELDS) {
+                        if (field === 'chatMessages' || field === 'history')
+                            continue;
+                        if (preferred[field] === undefined && priorPayload[field] !== undefined) {
+                            preferred[field] = priorPayload[field];
+                        }
+                    }
+                }
+                delete preferred.shard;
+                delete preferred.shardBytes;
                 merged[key] = preferred;
             }
             return {
@@ -2983,6 +3345,17 @@ class Agent {
                 conversations: merged,
             };
         });
+        // A deleted conversation must not leave its transcript shard behind.
+        for (const key of deletedKeys) {
+            const shardFile = this.conversationShardPath(String(key), ws);
+            if (!shardFile)
+                continue;
+            try {
+                fs.unlinkSync(shardFile);
+            }
+            catch { }
+            this.conversationShardFingerprint.delete(shardFile);
+        }
         stopTimer();
     }
     mutateStoredConversationState(ws, mutate, select) {
@@ -2992,9 +3365,15 @@ class Agent {
         fs.mkdirSync(path.dirname(file), { recursive: true });
         const lock = `${file}.lock`;
         let lockHandle = null;
-        for (let attempt = 0; attempt < 80; attempt += 1) {
+        for (let attempt = 0; attempt < 400; attempt += 1) {
             try {
                 lockHandle = fs.openSync(lock, 'wx');
+                // Record the owner so a lock left behind by a killed runtime can be
+                // reclaimed immediately instead of blocking saves for the age window.
+                try {
+                    fs.writeFileSync(lockHandle, String(process.pid), 'utf-8');
+                }
+                catch { }
                 break;
             }
             catch (error) {
@@ -3003,7 +3382,22 @@ class Agent {
                     throw error;
                 if (code === 'EEXIST') {
                     try {
-                        if (Date.now() - fs.statSync(lock).mtimeMs > 30000)
+                        const stat = fs.statSync(lock);
+                        const rawOwner = fs.readFileSync(lock, 'utf-8').trim();
+                        const ownerPid = Number(rawOwner);
+                        const knownOwner = rawOwner.length > 0 && Number.isFinite(ownerPid) && ownerPid > 0;
+                        const ownerAlive = knownOwner && (ownerPid === process.pid || (() => {
+                            try {
+                                process.kill(ownerPid, 0);
+                                return true;
+                            }
+                            catch {
+                                return false;
+                            }
+                        })());
+                        if (knownOwner && !ownerAlive)
+                            fs.unlinkSync(lock);
+                        else if (Date.now() - stat.mtimeMs > 30_000)
                             fs.unlinkSync(lock);
                     }
                     catch { }
@@ -3028,8 +3422,49 @@ class Agent {
         contentState.version = 3;
         contentState.conversations = contentState.conversations || {};
         const temp = `${file}.${process.pid}.${crypto.randomUUID()}.tmp`;
-        const diskConversations = Object.fromEntries(Object.entries(contentState.conversations || {})
-            .map(([key, entry]) => [key, this.conversationEntryForDisk(entry)]));
+        const shardDir = this.workspaceConversationShardDir(ws);
+        const diskConversations = {};
+        const pendingShards = [];
+        for (const [key, rawEntry] of Object.entries(contentState.conversations || {})) {
+            const entry = rawEntry;
+            const snapshot = this.conversationShardSnapshot(entry);
+            let shardFileName = typeof entry.shard === 'string' ? entry.shard : '';
+            let shardBytes = Number(entry.shardBytes) || 0;
+            let messageCount = Number(entry.messageCount) || 0;
+            let historyCount = Number(entry.historyCount) || 0;
+            let workRunCount = Number(entry.workRunCount) || 0;
+            let hasTree = !!entry.hasTree;
+            let hasBranches = !!entry.hasBranches;
+            let continuationCount = Number(entry.continuationCount) || 0;
+            let continuationRevision = Number(entry.continuationRevision) || 0;
+            if (snapshot && shardDir) {
+                const payload = this.conversationEntryForDisk(snapshot);
+                messageCount = Array.isArray(payload.chatMessages) ? payload.chatMessages.length : 0;
+                historyCount = Array.isArray(payload.history) ? payload.history.length : 0;
+                workRunCount = Array.isArray(payload.workRuns) ? payload.workRuns.length : 0;
+                hasTree = !!payload.tree;
+                hasBranches = Array.isArray(payload.branches) && payload.branches.length > 0;
+                continuationCount = Array.isArray(payload.continuations) ? payload.continuations.length : 0;
+                continuationRevision = Number(entry.continuationRevision) || this.continuationRevision;
+                // Shard content is the heavy payload only: no `updatedAt`, no metadata.
+                // A save that only bumps metadata therefore produces a byte-identical
+                // shard and is skipped by the fingerprint check below.
+                const shardContent = JSON.stringify({ version: 1, key, ...payload });
+                shardFileName = shardFileName || this.conversationShardFileName(key);
+                const shardFile = path.join(shardDir, shardFileName);
+                const shardFingerprint = crypto.createHash('sha1').update(shardContent).digest('hex');
+                if (this.conversationShardFingerprint.get(shardFile) !== shardFingerprint) {
+                    pendingShards.push({ file: shardFile, content: shardContent });
+                    this.conversationShardFingerprint.set(shardFile, shardFingerprint);
+                }
+                shardBytes = Buffer.byteLength(shardContent, 'utf8');
+            }
+            diskConversations[key] = this.conversationIndexEntryForDisk(entry, shardFileName || null, shardBytes, {
+                messageCount, historyCount, workRunCount, hasTree, hasBranches, continuationCount, continuationRevision,
+            });
+        }
+        for (const shard of pendingShards)
+            this.writeAtomicTextFile(shard.file, shard.content);
         const content = JSON.stringify({
             version: 3,
             activeConversationId: contentState.activeConversationId || this.activeConversationId || 'default',
@@ -3037,6 +3472,27 @@ class Agent {
             flowSuspensions: contentState.flowSuspensions || undefined,
             conversations: diskConversations,
         }, null, 2);
+        // Content-fingerprint short circuit: a save whose serialized document is
+        // byte-identical to what this process last wrote needs no temp file, no
+        // fsync and no rename. Repeated saves inside one turn (Build start, kernel
+        // events, work-run bookkeeping) usually collapse into this case.
+        const contentFingerprint = crypto.createHash('sha1').update(content).digest('hex');
+        const knownDiskFingerprint = this.conversationStateCacheFingerprint.get(file);
+        let diskUntouched = false;
+        if (knownDiskFingerprint) {
+            try {
+                const current = fs.statSync(file, { bigint: true });
+                diskUntouched = knownDiskFingerprint === `${current.mtimeNs}:${current.ctimeNs}:${current.size}`;
+            }
+            catch {
+                diskUntouched = false;
+            }
+        }
+        if (diskUntouched && this.conversationStateWrittenFingerprint.get(file) === contentFingerprint) {
+            this.conversationStateCache.set(file, contentState);
+            this.conversationStateLastWriteAt.set(file, Date.now());
+            return select ? select(contentState) : undefined;
+        }
         try {
             const handle = fs.openSync(temp, 'w');
             try {
@@ -3051,6 +3507,8 @@ class Agent {
                 try {
                     fs.renameSync(temp, file);
                     this.conversationStateCache.set(file, contentState);
+                    this.conversationStateWrittenFingerprint.set(file, contentFingerprint);
+                    this.conversationStateLastWriteAt.set(file, Date.now());
                     const writtenStat = fs.statSync(file, { bigint: true });
                     this.conversationStateCacheFingerprint.set(file, `${writtenStat.mtimeNs}:${writtenStat.ctimeNs}:${writtenStat.size}`);
                     return select ? select(contentState) : undefined;
@@ -3154,11 +3612,17 @@ class Agent {
             if (prefix && !key.startsWith(prefix))
                 continue;
             const id = key.slice(prefix.length + 1) || key;
+            // Index-resident counts: listing conversations must never hydrate a
+            // shard, otherwise every UI refresh would parse every transcript.
+            const entry = value;
+            const shardBacked = typeof entry.shard === 'string' && !!entry.shard;
             rows.push({
                 id,
                 key,
-                title: value.title || this.titleFromMessages(value.chatMessages || [], id),
-                messageCount: value.chatMessages?.length || 0,
+                title: value.title || (shardBacked
+                    ? String(entry.title || id)
+                    : this.titleFromMessages(value.chatMessages || [], id)),
+                messageCount: Number(value.messageCount) || value.chatMessages?.length || 0,
                 historyCount: value.history?.length || 0,
                 updatedAt: value.updatedAt || '',
                 pinned: !!value.pinned,
@@ -3756,6 +4220,10 @@ class Agent {
             return false;
         existing.pinned = !!pinned;
         existing.pinnedAt = existing.pinned ? new Date().toISOString() : '';
+        // The pin is a real change: advance `updatedAt` so a concurrent older
+        // snapshot (which ties on the previous timestamp) cannot win the merge and
+        // silently unpin the conversation.
+        existing.updatedAt = new Date().toISOString();
         const siblingOrders = Object.entries(stored.conversations)
             .filter(([key, value]) => key !== stateKey && !!value.pinned === existing.pinned && Number.isFinite(value.order))
             .map(([, value]) => Number(value.order));
@@ -3782,6 +4250,7 @@ class Agent {
                 return item;
             return byId.get(orderedIds[nextIndex++]);
         });
+        this.continuationRevision += 1;
         this.saveWorkspaceConversationState(true);
         return this.conversationContinuations();
     }
@@ -4133,6 +4602,12 @@ class Agent {
             this.firstAgentResponseStarted = true;
             return true;
         }
+        // This is a hard durability gate: it verifies the flag by reading the store
+        // back, so the snapshot produced by the current turn must be on disk first.
+        // Intermediate saves are coalesced, which can leave the entry unwritten for
+        // up to one throttle window; flush it synchronously here instead of relying
+        // on timing.
+        this.saveWorkspaceConversationState(true);
         const marked = this.mutateStoredConversationState(workspace, latest => {
             const current = latest.conversations?.[stateKey];
             const firstUser = (current?.chatMessages || []).find(message => message.role === 'user');
@@ -4194,7 +4669,14 @@ class Agent {
             if (orderSlots.some(order => !Number.isFinite(order)))
                 return latest;
             orderSlots.sort((a, b) => a - b);
-            normalized.forEach((id, index) => { entryById.get(id).order = orderSlots[index]; });
+            const reorderedAt = new Date().toISOString();
+            normalized.forEach((id, index) => {
+                const entry = entryById.get(id);
+                entry.order = orderSlots[index];
+                // Same reason as pinning: keep a real change strictly newer than any
+                // snapshot a coalesced save may still be holding.
+                entry.updatedAt = reorderedAt;
+            });
             accepted = true;
             return latest;
         });
@@ -4310,6 +4792,7 @@ class Agent {
             subagentState: this.subagents.serialize(),
             workRuns: this.normalizeWorkRuns(this.workRuns),
             continuations: this.normalizeContinuations(this.continuations),
+            continuationRevision: this.continuationRevision,
             modelSelection: this.currentConversationModelSelection(),
             flowSelection: this.currentConversationFlowSelection(),
             inputMode: this.inputMode,
@@ -4356,6 +4839,7 @@ class Agent {
             runtimeOwnerId: runtimeOwner.runtimeOwnerId,
             runtimeOwnerPid: runtimeOwner.runtimeOwnerPid,
             runtimeLifecycleRole: runtimeOwner.runtimeLifecycleRole,
+            continuationRevision: this.continuationRevision,
             updatedAt,
         };
         if (nextEntry.tree || nextEntry.branches?.length) {
@@ -4383,6 +4867,7 @@ class Agent {
             this.linkedPlan = { markdown: '', revision: 0 };
             this.workRuns = [];
             this.continuations = [];
+            this.continuationRevision = 0;
             this.mode = 'build';
             this.goal = null;
             this.titleRequestMessageId = '';
@@ -4409,6 +4894,7 @@ class Agent {
             this.bindConversationSubagents(this.activeConversationId, saved.subagentState);
             this.workRuns = this.normalizeWorkRuns(saved.workRuns);
             this.continuations = this.normalizeContinuations(saved.continuations);
+            this.continuationRevision = Number(saved.continuationRevision || 0);
             this.restoreConversationModelSelection(saved.modelSelection);
             this.restoreConversationFlowSelection(saved.flowSelection);
             this.inputMode = this.defaultInputMode();
@@ -4438,6 +4924,7 @@ class Agent {
         const recoveredWorkRuns = this.recoverPersistedWorkRuns(persisted?.workRuns, persisted?.updatedAt, this.runtimeLifecycle.unexpectedExit);
         this.workRuns = recoveredWorkRuns.runs;
         this.continuations = this.normalizeContinuations(persisted?.continuations);
+        this.continuationRevision = Number(persisted?.continuationRevision || 0);
         this.restoreConversationModelSelection(persisted?.modelSelection);
         this.restoreConversationFlowSelection(persisted?.flowSelection);
         this.inputMode = this.defaultInputMode();
@@ -5795,6 +6282,7 @@ class Agent {
                 this.subagents = source.subagents;
             this.workRuns = workRuns;
             this.continuations = continuations;
+            this.continuationRevision += 1;
             this.mode = source.mode || this.mode;
             if (source.goal !== undefined)
                 this.goal = this.restoreGoal(source.goal);
@@ -6637,7 +7125,9 @@ class Agent {
             : (memory?.history ?? persisted?.history ?? []);
         const messages = this.normalizeConversationChatMessages(sourceMessages, sourceHistory);
         const filename = this.writeSessionArchive(messages, this.modeName(), this.model);
-        const archiveEntry = persisted ? JSON.parse(JSON.stringify(persisted)) : {
+        // Materialize the shard-backed entry before cloning: a plain JSON round-trip
+        // of the index record would archive an empty transcript and no branch tree.
+        const archiveEntry = persisted ? JSON.parse(JSON.stringify(this.conversationEntryForDisk(persisted))) : {
             title: this.titleFromMessages(messages, clean),
             chatMessages: messages,
             history: sourceHistory,
@@ -6649,6 +7139,9 @@ class Agent {
             continuations: memory?.continuations,
             updatedAt: new Date().toISOString(),
         };
+        for (const key of ['shard', 'shardBytes', 'messageCount', 'historyCount', 'workRunCount', 'hasTree', 'hasBranches']) {
+            delete archiveEntry[key];
+        }
         const manifest = {
             version: 2,
             kind: 'newmark-conversation-archive',
@@ -6715,6 +7208,24 @@ class Agent {
         const cachedStored = this.readStoredConversationState(ws);
         const stored = JSON.parse(JSON.stringify(cachedStored || {}));
         const persisted = stored.conversations?.[stateKey];
+        // A shard-backed index record keeps `chatMessages` / `history` / `workRuns`
+        // / `tree` behind non-enumerable accessors, and the JSON round-trip above
+        // drops exactly those. Without this the archive of a conversation this
+        // process does not hold in memory (the GUI archives while a utility runtime
+        // owns the transcript) writes an empty payload -- and then deletes the real
+        // transcript from the store. Read the live record's payload into the
+        // detached copy instead.
+        const cachedEntry = (cachedStored.conversations || {})[stateKey];
+        if (persisted && cachedEntry) {
+            for (const field of Agent.CONVERSATION_SHARD_FIELDS) {
+                if (persisted[field] !== undefined)
+                    continue;
+                const value = cachedEntry[field];
+                if (value === undefined)
+                    continue;
+                persisted[field] = JSON.parse(JSON.stringify(value));
+            }
+        }
         if (persisted)
             this.normalizeConversationTree(persisted);
         const memory = this.workspaceConversations.get(memoryKey);
@@ -6735,7 +7246,8 @@ class Agent {
             model: archiveModel,
             goal: archiveGoal,
         }, archiveDir);
-        const archiveEntry = persisted ? JSON.parse(JSON.stringify(persisted)) : {
+        // Same materialization rule as the synchronous archive path.
+        const archiveEntry = persisted ? JSON.parse(JSON.stringify(this.conversationEntryForDisk(persisted))) : {
             title: this.titleFromMessages(messages, clean),
             chatMessages: messages,
             history: sourceHistory,
@@ -6747,6 +7259,9 @@ class Agent {
             continuations: memory?.continuations,
             updatedAt: new Date().toISOString(),
         };
+        for (const key of ['shard', 'shardBytes', 'messageCount', 'historyCount', 'workRunCount', 'hasTree', 'hasBranches']) {
+            delete archiveEntry[key];
+        }
         const manifest = {
             version: 2,
             kind: 'newmark-conversation-archive',
@@ -6792,6 +7307,19 @@ class Agent {
             nextActiveId = latest.activeConversationId || remaining[0] || 'default';
             return latest;
         });
+        // The index record is gone, so its transcript shard must go with it: an
+        // orphaned shard is dead weight now and a stale transcript source if the
+        // same conversation id is ever written again. The synchronous archive path
+        // deletes shards through `writeStoredConversationState(...deletedKeys)`; the
+        // async path mutates the locked state directly, so it unlinks here.
+        const archivedShardFile = this.conversationShardPath(stateKey, ws);
+        if (archivedShardFile) {
+            try {
+                fs.unlinkSync(archivedShardFile);
+            }
+            catch { /* already gone */ }
+            this.conversationShardFingerprint.delete(archivedShardFile);
+        }
         this.workspaceConversations.delete(memoryKey);
         const duplicateMemoryKey = `${ws.isInternal ? 'internal' : 'external'}:${path.resolve(ws.path)}::conversation:${clean}`;
         this.workspaceConversations.delete(duplicateMemoryKey);
@@ -7113,7 +7641,7 @@ class Agent {
                     capabilities.add(capability);
                 }
             }
-            const health = this.autoRouter.endpointMetrics(this.deploymentRef(model));
+            const health = this.routeController.endpointMetrics(this.deploymentRef(model));
             const latencySeconds = Number(model.evaluation?.latency);
             const configuredPrivacy = (model.privacy || ['default']).filter(value => value === 'default' || value === 'no_training' || value === 'zdr');
             const supportedParameters = new Set((routeMetadata.supported_parameters || []).map(value => String(value).toLowerCase()));
@@ -7133,6 +7661,7 @@ class Agent {
             return {
                 deployment: this.deploymentRef(model),
                 enabled: model.enabled !== false,
+                unavailableReason: this.isBalanceBlockedDeployment(this.deploymentRef(model)) ? 'balance_blocked' : undefined,
                 validation: {
                     level: validation.level,
                     status: effectiveValidationStatus,
@@ -7154,7 +7683,7 @@ class Agent {
                 reliability: health.attempts ? health.reliability : 0.5,
                 toolValidity: health.toolAttempts ? health.toolValidity : undefined,
                 throughput: health.throughput ?? (model.speed_rating === 'fast' ? 80 : model.speed_rating === 'medium' ? 40 : model.speed_rating === 'slow' ? 15 : undefined),
-                qualityByTask: model.quality_by_task,
+                circuit: health.circuit,
                 preference: Number.isFinite(Number(routeMetadata.route_preference)) ? Number(routeMetadata.route_preference) : undefined,
                 fallbackOnly: !!model.fallback_only,
             };
@@ -7170,40 +7699,6 @@ class Agent {
             // Routing remains available when metrics-only audit storage is read-only.
         }
     }
-    loadLearnedRouteFeedback() {
-        try {
-            const file = path.join(this.rootPath, 'routing', 'feedback.jsonl');
-            if (!fs.existsSync(file))
-                return;
-            const lines = fs.readFileSync(file, 'utf-8').split(/\r?\n/).filter(Boolean).slice(-2000);
-            for (const line of lines) {
-                const value = JSON.parse(line);
-                const deployment = value.deployment;
-                if (!deployment?.providerId || !deployment.modelId)
-                    continue;
-                if (!['chat', 'coding', 'reasoning', 'long_context', 'vision', 'image_generation', 'tool_use', 'computer_use'].includes(String(value.taskClass)))
-                    continue;
-                if (!['manual_switch', 'explicit_rating', 'objective_success'].includes(String(value.source)))
-                    continue;
-                if (!Number.isFinite(Number(value.score)) || !Number.isFinite(Number(value.at)))
-                    continue;
-                this.autoRouter.recordFeedback(value);
-            }
-        }
-        catch {
-            // A malformed preference log is ignored instead of influencing routing.
-        }
-    }
-    recordRouteFeedbackFor(deployment, taskClass, score, source) {
-        const event = { deployment: { ...deployment }, taskClass, score, source, at: Date.now() };
-        this.autoRouter.recordFeedback(event);
-        try {
-            const directory = path.join(this.rootPath, 'routing');
-            fs.mkdirSync(directory, { recursive: true });
-            fs.appendFileSync(path.join(directory, 'feedback.jsonl'), `${JSON.stringify(event)}\n`, 'utf-8');
-        }
-        catch { }
-    }
     allModelNames() {
         const names = this.config.allModels().filter(m => m.enabled !== false).map(m => {
             const label = m.display || m.name;
@@ -7218,13 +7713,8 @@ class Agent {
         const before = this.resolvedDeployment ? deploymentIdentity(this.resolvedDeployment) : '';
         const mode = override?.mode || (0, autoRouter_1.normalizeAutoPreference)(this.config.autoSwitchPreference());
         const policy = (0, autoRouter_1.defaultRoutePolicy)(mode);
-        const configuredQualityLoss = this.config.get('models', 'auto_max_quality_loss');
-        if (typeof configuredQualityLoss === 'number' && Number.isFinite(configuredQualityLoss) && configuredQualityLoss >= 0) {
-            policy.maxQualityLoss = Math.min(1, configuredQualityLoss);
-        }
-        if (typeof override?.maxQualityLoss === 'number' && Number.isFinite(override.maxQualityLoss) && override.maxQualityLoss >= 0) {
-            policy.maxQualityLoss = Math.min(1, override.maxQualityLoss);
-        }
+        // The tendency is guidance for the current-model JEV decision. Eligibility
+        // and explicit cost ceilings remain hard constraints.
         const maxExpectedCost = this.config.get('models', 'auto_max_expected_cost_usd');
         if (typeof maxExpectedCost === 'number' && Number.isFinite(maxExpectedCost) && maxExpectedCost > 0)
             policy.maxExpectedCostUsd = maxExpectedCost;
@@ -7277,27 +7767,141 @@ class Agent {
         };
         const ownsTransaction = !this.routeTransactionId;
         const transactionId = this.routeTransactionId || `route-${crypto.randomUUID()}`;
-        const decision = this.autoRouter.route(selection, policy, this.autoRouteCandidates(), {
+        const estimatedInputTokens = this.estimateContextTokens();
+        const expectedOutputTokens = this.intelligence === 'ultra' || this.intelligence === 'max' ? 32768
+            : this.intelligence === 'xhigh' ? 16384
+                : this.intelligence === 'high' ? 8192
+                    : this.intelligence === 'low' ? 2048 : 4096;
+        const routeRequest = {
             transactionId,
-            affinityKey: `${this.workspace.current?.path || this.rootPath}\u0000${this.activeConversationId || 'default'}`,
             taskText: task,
-            estimatedInputTokens: this.estimateContextTokens(),
-            expectedOutputTokens: this.intelligence === 'ultra' || this.intelligence === 'max' ? 32768
-                : this.intelligence === 'xhigh' ? 16384
-                    : this.intelligence === 'high' ? 8192
-                        : this.intelligence === 'low' ? 2048 : 4096,
+            estimatedInputTokens,
+            expectedOutputTokens,
             requiredCapabilities: [...requiredCapabilities],
             batch: override?.batch === true,
+        };
+        const decision = await this.decideAutoRoute({
+            selection,
+            policy,
+            task,
+            request: routeRequest,
+            candidates: this.autoRouteCandidates(),
         });
         if (ownsTransaction)
-            this.autoRouter.endTransaction(transactionId);
+            this.routeController.endTransaction(transactionId);
+        else if (decision.resolvedDeployment)
+            this.routeController.pinTransaction(transactionId, decision.resolvedDeployment);
+        if (decision.resolvedDeployment)
+            this.routeController.claimEndpointAttempt(decision.resolvedDeployment);
         this.lastRouteDecision = decision;
-        this.resolvedDeployment = decision.resolvedDeployment ? { ...decision.resolvedDeployment } : null;
+        // Auto Router v2 freeze rule: a decision that produced no deployment must
+        // not move the conversation to another model. Keeping the previous resolved
+        // deployment is what makes "Auto off / decision model off never changes my
+        // model" observable behaviour instead of a silent re-selection.
+        if (decision.resolvedDeployment) {
+            this.resolvedDeployment = { ...decision.resolvedDeployment };
+        }
+        else if (decision.finalStatus !== 'no_candidate') {
+            this.resolvedDeployment = null;
+        }
         this.pendingAutoAttempts = [];
         this.routeAttemptStartedAt = this.resolvedDeployment ? Date.now() : 0;
         this.persistRouteDecision(decision);
         return !!this.resolvedDeployment && before !== deploymentIdentity(this.resolvedDeployment);
     }
+    /**
+     * Auto Router v2 decision pipeline:
+     *
+     *   RouteEligibilityGuard → JevDecisionEngine → RouteDecisionValidator → pin
+     *
+     * The current conversation model is the only Auto decision source. If it is
+     * disabled, times out, crashes or returns something the guard cannot accept,
+     * Auto stops without selecting another deployment.
+     */
+    async decideAutoRoute(input) {
+        const { selection, policy, task, request, candidates } = input;
+        const taskClasses = (0, autoRouter_1.classifyTaskClasses)(task, [...policy.requiredCapabilities, ...request.requiredCapabilities], request.estimatedInputTokens);
+        const stopTimer = (0, performanceDiagnostics_1.performanceTimer)('jev_route_decision', { conversationId: this.activeConversationId || 'default' });
+        try {
+            const configuredTimeout = Number(this.config.get('models', 'jev_timeout_ms'));
+            const jevUsageRequest = this.beginProviderUsageRequest();
+            const jev = this.resolveCurrentModelJevEngine(jevUsageRequest);
+            return await (0, routeDecisionValidator_1.resolveAutoRouteDecision)({
+                selection,
+                policy,
+                taskText: task,
+                request,
+                candidates,
+                taskClasses,
+                intelligence: this.intelligence,
+                engine: jev.engine || undefined,
+                unavailableReason: jev.unavailableReason,
+                timeoutMs: Number.isFinite(configuredTimeout) && configuredTimeout > 0 ? configuredTimeout : jevDecision_1.DEFAULT_JEV_TIMEOUT_MS,
+                previousDeployment: this.resolvedDeployment,
+                pinnedDeployment: this.routeTransactionId ? this.routeController.transactionPin(request.transactionId) : undefined,
+                policyVersion: this.routeController.version(),
+            });
+        }
+        finally {
+            stopTimer();
+        }
+    }
+    /** Resolve JEV to the current eligible conversation model, never a second model slot. */
+    resolveCurrentModelJevEngine(usageRequest) {
+        const jevEnabled = this.config.get('models', 'jev_enabled') !== false;
+        const decisionEnabled = this.config.autoSwitchEnabled() && jevEnabled;
+        const engine = !decisionEnabled
+            ? null
+            : new jevDecision_1.CurrentModelJevDecisionEngine(request => {
+                const eligible = request.candidates;
+                if (!eligible.length)
+                    return null;
+                const eligibleByIdentity = new Map(eligible.map(candidate => [
+                    `${candidate.deployment.providerId}\u0000${candidate.deployment.modelId}`,
+                    candidate,
+                ]));
+                const availableModels = eligible.flatMap(candidate => {
+                    const model = this.config.findDeployment(candidate.deployment);
+                    return model?.provider_url && model.api_key ? [{ candidate, model }] : [];
+                });
+                const preferredDeployment = request.previous?.deployment || this.activeDeployment();
+                const defaultSelection = this.config.getStr('models', 'default_model');
+                const defaultRef = parseDeploymentSelectionValue(defaultSelection);
+                const defaultModel = defaultRef
+                    ? this.config.findDeployment(defaultRef)
+                    : this.config.findModel(defaultSelection);
+                const defaultDeployment = defaultModel ? this.deploymentRef(defaultModel) : null;
+                const preferred = preferredDeployment
+                    ? eligibleByIdentity.get(`${preferredDeployment.providerId}\u0000${preferredDeployment.modelId}`)
+                    : undefined;
+                const configuredDefault = defaultDeployment
+                    ? eligibleByIdentity.get(`${defaultDeployment.providerId}\u0000${defaultDeployment.modelId}`)
+                    : undefined;
+                const selected = availableModels.find(entry => preferred
+                    && entry.candidate.deployment.providerId === preferred.deployment.providerId
+                    && entry.candidate.deployment.modelId === preferred.deployment.modelId)
+                    || availableModels.find(entry => configuredDefault
+                        && entry.candidate.deployment.providerId === configuredDefault.deployment.providerId
+                        && entry.candidate.deployment.modelId === configuredDefault.deployment.modelId)
+                    || availableModels[0];
+                if (!selected)
+                    return null;
+                const modelIdentity = `${selected.model.provider_id}/${selected.model.name}`;
+                return {
+                    provider: this.modelProvider(selected.model, this.jevProviderCache),
+                    model: selected.model.name,
+                    modelVersion: `${jevDecision_1.CURRENT_MODEL_JEV_VERSION}:${modelIdentity}`,
+                    thinkingCapable: selected.model.thinking === true,
+                    onUsage: usage => this.recordProviderUsage(usage, usageRequest),
+                };
+            });
+        return {
+            engine,
+            unavailableReason: !this.config.autoSwitchEnabled()
+                ? 'auto_disabled'
+                : 'disabled',
+        };
+    }
     shouldExposeToolInterface() {
         return true;
     }
@@ -7333,7 +7937,7 @@ class Agent {
             return null;
         }
         if (observedDeployment)
-            this.autoRouter.recordEndpointFailure(observedDeployment, observedFailure);
+            this.routeController.recordEndpointFailure(observedDeployment, observedFailure);
         if (this.model === 'auto') {
             const current = this.activeDeployment();
             if (!current || !this.lastRouteDecision)
@@ -7351,7 +7955,7 @@ class Agent {
                     currentAttempt.durationMs = Math.max(0, Date.now() - this.routeAttemptStartedAt);
             }
             if (!this.pendingAutoAttempts.length) {
-                this.pendingAutoAttempts = this.autoRouter.planAttempts(this.lastRouteDecision, this.autoRouteCandidates(), {
+                this.pendingAutoAttempts = this.routeController.planAttempts(this.lastRouteDecision, this.autoRouteCandidates(), {
                     error: failure,
                     streamCommitted: this.routeStreamCommitted,
                     sideEffectCommitted: this.routeSideEffectCommitted,
@@ -7371,7 +7975,7 @@ class Agent {
             this.lastRouteDecision.attempts.push({ ...next });
             this.lastRouteDecision.resolvedDeployment = { ...next.deployment };
             this.lastRouteDecision.finalStatus = 'retrying';
-            this.autoRouter.claimEndpointAttempt(next.deployment);
+            this.routeController.claimEndpointAttempt(next.deployment);
             this.routeAttemptStartedAt = Date.now();
             this.persistRouteDecision(this.lastRouteDecision);
             return current.modelId;
@@ -7389,8 +7993,9 @@ class Agent {
         const usable = all.filter(m => !modelConfigIsUnavailable(m) && !this.failedDeploymentsThisRun.has(deploymentIdentity(this.deploymentRef(m))));
         if (!usable.length)
             return null;
-        const pref = this.config.autoSwitchPreference();
-        const ranked = [...usable].sort((a, b) => this.modelScore(b, pref, false, false) - this.modelScore(a, pref, false, false));
+        // Operational recovery is independent of the user-facing Auto tendency;
+        // that tendency is supplied only to the current-model JEV decision.
+        const ranked = [...usable].sort((a, b) => this.modelScore(b, 'balanced', false, false) - this.modelScore(a, 'balanced', false, false));
         const next = ranked[0];
         if (!next?.name)
             return null;
@@ -8322,8 +8927,14 @@ class Agent {
             stopTotalTimer();
             this.processDepth = Math.max(0, this.processDepth - 1);
             if (this.processDepth === 0) {
+                // Kernel events coalesce intermediate writes to avoid rewriting the
+                // workspace document on every token. A completed Agent turn is a
+                // durability boundary across GUI, TUI, and one-shot CLI runtimes; do
+                // the terminal write here so callers can safely read or exit as soon
+                // as process() resolves.
+                this.flushConversationState();
                 if (this.routeTransactionId)
-                    this.autoRouter.endTransaction(this.routeTransactionId);
+                    this.routeController.endTransaction(this.routeTransactionId);
                 this.routeTransactionId = '';
                 this.processingConversationId = null;
                 this.activeProcessAbortController = null;