pi-legion 3.0.3 → 4.0.0

package/src/extension/runtime.ts

@@ -33,8 +33,15 @@ import {
 	type WidgetTui,
 } from "../tui/status.ts";
 import { progressFromSessionFile } from "../shared/progress.ts";
+import { readProcRss } from "../supervisor/proc-memory.ts";
 import { isTransientConnectionFailure } from "../shared/session.ts";
-import { DEFAULTS, type AgentKind, type RetireOptions } from "../shared/types.ts";
+import { isTerminalState, liveness } from "./liveness.ts";
+import {
+	DEFAULTS,
+	type AgentKind,
+	type RetireOptions,
+	type SpawnMode,
+} from "../shared/types.ts";
 import type {
 	EventSubscriptionOptions,
 	SupervisorEvent,
@@ -45,6 +52,7 @@ import { createDbEventSource, type DbEventSource } from "./event-bus.ts";
 import { openLegionDb, type DatabaseSync } from "../legion/db.ts";
 import { getSubtree } from "../legion/nodes.ts";
 import { attachUsageTotals } from "../legion/usage.ts";
+import { maxEventId } from "../legion/events.ts";
 import type { TreeNodeSnapshot } from "../tui/tree-view.ts";
 
 export interface CollectSnapshot {
@@ -76,6 +84,18 @@ export interface TrackedJobInput {
 	model?: string;
 	thinking?: string | false;
 	worktreeBranch?: string;
+	/**
+	 * Arbitrated backend for this child (`Handle.spawnMode`, #209). Optional:
+	 * a job tracked from a legacy record has no value and must render as
+	 * unknown rather than a guessed `rpc`.
+	 */
+	spawnMode?: SpawnMode;
+	/**
+	 * OS process of an `rpc` child (`Handle.pid`), for the memory probe only.
+	 * Optional: an `inprocess` child has no process of its own, and a legacy
+	 * record has no value. Never persisted — a pid is host-scoped.
+	 */
+	pid?: number;
 	/** Legion tree identity supplied by the host when the M2 ChildRecord is available. */
 	nodeId?: string;
 	parentId?: string | null;
@@ -151,6 +171,16 @@ export interface SessionRuntimeDeps {
 }
 
 const DEFAULT_REFRESH_MS = 500;
+/**
+ * How long a ledger heartbeat stays trustworthy (D3/D7).
+ *
+ * Mirrors `DEFAULT_ORPHAN_STALE_MS` in `legion-tools.ts` and the `orphanStaleMs`
+ * setting default (`src/shared/types.ts`). Duplicated as a literal on purpose:
+ * the TUI refresh path must not read settings on every repaint, and this value is
+ * the horizon for "a row that stopped heartbeating", which is exactly the orphan
+ * definition. Keep the three in sync.
+ */
+const DEFAULT_ORPHAN_STALE_MS = 90_000;
 /**
  * Hard cap on how long a completion notice may stay hidden behind a live
  * parent agent run (D-B). 80s = 2× the (1+3)×10s that the old join window
@@ -234,6 +264,20 @@ export interface LiveChildStatusInput {
 	 * by the owner marker instead. Only consulted when `alive` is false.
 	 */
 	owner?: "live" | "dead" | "unknown";
+	/**
+	 * Own OS process of an `rpc` child (`Handle.pid`), when this session owns it.
+	 *
+	 * Only a pid of THIS host is ever supplied — pids are not persisted, so a
+	 * record from a previous session has none. `inprocess` children have none by
+	 * definition: they share this process.
+	 */
+	pid?: number;
+	/**
+	 * Context size of the last assistant message. Explicit override; otherwise
+	 * derived from `sessionFile` through `progressFromSessionFile` — the same
+	 * `accumulateUsage` source of truth the widget reads.
+	 */
+	contextTokens?: number;
 	now?: number;
 }
 
@@ -302,6 +346,52 @@ function ownerLine(owner: "live" | "dead" | "unknown"): string {
 	return `owner: ${owner}`;
 }
 
+/** Compact token count: `950`, `24.3K`, `1.4M` — absolute, never a percentage. */
+export function formatContextTokens(value: number): string {
+	if (!Number.isFinite(value) || value <= 0) return "0";
+	const unit = value >= 1_000_000 ? "M" : value >= 1_000 ? "K" : "";
+	const divisor = unit === "M" ? 1_000_000 : unit === "K" ? 1_000 : 1;
+	if (!unit) return String(Math.round(value));
+	return `${(value / divisor).toFixed(1).replace(/\.0$/, "")}${unit}`;
+}
+
+/** Context size of the child's own session, when it has one to read. */
+function contextTokensFor(sessionFile: string): number | undefined {
+	if (!sessionFile) return undefined;
+	const live = progressFromSessionFile(sessionFile);
+	return live.contextTokens;
+}
+
+/**
+ * Memory line for one child, following D2: only an `rpc` child owns a process,
+ * so only it gets a per-child RSS. An `inprocess` child runs INSIDE this host
+ * process — apportioning the host RSS across children would be invented data,
+ * so it reports the shared host figure and says so.
+ *
+ * A memory figure describes a process that is running NOW, so a child that the
+ * liveness check reports gone gets no line at all (§6). Its pid may already
+ * belong to an unrelated process: reading `/proc/<pid>` then would print a
+ * stranger's RSS under this child's name — fabricated attribution that looks
+ * real, the exact thing D2 forbids. v1 keeps no last-known cache, so there is
+ * nothing honest left to show.
+ *
+ * `undefined` when there is nothing honest to print (child not alive, no pid,
+ * non-Linux host, pid already gone).
+ */
+function memoryLine(input: LiveChildStatusInput): string | undefined {
+	// §6 pid-reuse race: never probe a pid whose process is already gone.
+	if (!input.alive) return undefined;
+	if (input.spawnMode === "inprocess") {
+		const host = readProcRss(process.pid);
+		if (!host) return undefined;
+		return `memory: host rss=${host.rssMb}m (shared by inprocess children)`;
+	}
+	if (input.pid === undefined) return undefined;
+	const own = readProcRss(input.pid);
+	if (!own) return undefined;
+	return `memory: rss=${own.rssMb}m${own.peakMb !== undefined ? ` peak=${own.peakMb}m` : ""}`;
+}
+
 /**
  * Status text for one child (`/legion status <name>` and `subagent status`).
  *
@@ -354,6 +444,12 @@ export function renderLiveChildStatus(input: LiveChildStatusInput): string {
 			`${acceptanceLabel}: ${input.acceptance.status}${input.acceptance.level ? ` (${input.acceptance.level})` : ""}`,
 		);
 	}
+	// Live resource facts. Appended as their own lines: every line above keeps
+	// its text and position, so existing readers of this block stay valid.
+	const contextTokens = input.contextTokens ?? contextTokensFor(input.sessionFile);
+	if (contextTokens !== undefined) lines.push(`context: ctx=${formatContextTokens(contextTokens)} tok`);
+	const memory = memoryLine(input);
+	if (memory) lines.push(memory);
 	lines.push(...meta);
 	if (stale) {
 		const persistedExecution = input.execution
@@ -605,6 +701,35 @@ export function createSessionRuntime(deps: SessionRuntimeDeps): SessionRuntime {
 	});
 	join.setConfig(joinConfig);
 
+	/**
+	 * D3/D8: the orphan horizon, matching `legion-tools.ts`'s DEFAULT_ORPHAN_STALE_MS.
+	 *
+	 * `runtime.ts` has no settings dependency (the TUI layer must not read
+	 * settings per repaint), so this mirrors the documented default. A ledger row
+	 * whose heartbeat is older than this cannot describe a live child.
+	 */
+	const orphanStaleMs = (): number => DEFAULT_ORPHAN_STALE_MS;
+
+	/**
+	 * D3/D8: the in-process facts for a node, keyed by tree id.
+	 *
+	 * A tracked job is both the strongest liveness evidence (rules 1/2: this very
+	 * process holds the handle) and the scheduler record. Resolved once per node
+	 * rather than by scanning `jobs` twice.
+	 */
+	const inProcessFactsFor = (
+		nodeId: string,
+	): { inMemory?: { state: string }; record?: { state: string } } => {
+		for (const job of jobs.values()) {
+			if (job.state === undefined) continue;
+			const matches =
+				job.nodeId === nodeId ||
+				(job.nodeId === undefined && deps.getTreeIdentity?.(job.name)?.nodeId === nodeId);
+			if (matches) return { inMemory: { state: job.state }, record: { state: job.state } };
+		}
+		return {};
+	};
+
 	const snapshotNodes = (): TreeNodeSnapshot[] => {
 		const ledger = ledgerDb;
 		const provided = deps.getTreeNodes
@@ -613,23 +738,100 @@ export function createSessionRuntime(deps: SessionRuntimeDeps): SessionRuntime {
 		if (provided !== undefined) {
 			tree.clear();
 			for (const node of provided) {
+				// D3: no timestamp race. `override.ts` comes from THIS process's event
+				// bus while `node.updatedAt` comes from the CHILD's heartbeat, and a
+				// dead child stops heartbeating (`legion-tools.ts` only heartbeats
+				// `isAlive` children), so its `updatedAt` freezes. Comparing the two
+				// therefore ranked two different clocks, and when the override looked
+				// older the code DELETED it and trusted the frozen row — which pulled
+				// finished nodes back to `running`. That was the whole reported bug.
+				//
+				// D8: render is a projection of facts, not a replay of events. The
+				// lifecycle verdict now comes from `liveness()`; the override only
+				// contributes fields that are NOT a lifecycle claim (`phase`), plus an
+				// optimistic status that must still agree with `liveness()`.
 				const override = eventOverrides.get(node.id);
-				if (override && override.ts >= node.updatedAt) {
-					tree.set(node.id, {
-						...node,
-						...(override.status === undefined ? {} : { status: override.status }),
-						...(override.phase === undefined ? {} : { phase: override.phase }),
-						updatedAt: override.ts,
-					});
-				} else {
-					if (override) eventOverrides.delete(node.id);
-					tree.set(node.id, { ...node });
-				}
+				const verdict = liveness({
+					ledger: { status: node.status, updatedAt: node.updatedAt },
+					...inProcessFactsFor(node.id),
+					now: now(),
+					staleMs: orphanStaleMs(),
+				});
+				// What the verdict decides, and what it does NOT decide:
+				//
+				//  - `dead` wins over a non-terminal row. A row that stopped
+				//    heartbeating cannot describe a live child, so it is rendered as
+				//    failed rather than left looking alive.
+				//  - `unknown` never promotes a row to `running` and never claims death.
+				//  - `live` says the child IS alive; it does not say WHICH alive state.
+				//    The ledger row only advances on heartbeat (coarse), while an event
+				//    says exactly what happened (`node_launched` → running). So a live
+				//    verdict keeps the MORE SPECIFIC of the two: an override status from
+				//    this process's own bus wins over the row, because it is the same
+				//    lifecycle seen at a finer grain. Only a terminal row outranks it —
+				//    a settled/failed row is a fact that no later "running" may erase.
+				//
+				// Two override cases outrank the row, and they cover both directions
+				// the coarse heartbeat cannot express:
+				//  - the override is TERMINAL (`node_settled`) while the row has not
+				//    caught up: the event ends the child now, not on the next heartbeat;
+				//  - both are non-terminal and the event is more specific
+				//    (`node_launched` → running vs a stale `starting` row).
+				// A terminal ROW always wins over a non-terminal override: once the
+				// ledger says settled/failed, no later "running" may erase that.
+				const overrideStatus = override?.status;
+				const rowTerminal = isTerminalState(node.status);
+				const overrideTerminal = overrideStatus !== undefined && isTerminalState(overrideStatus);
+				const status =
+					verdict === "dead" && !rowTerminal
+						? "failed"
+						: overrideStatus !== undefined && !rowTerminal && (overrideTerminal || verdict === "live")
+							? overrideStatus
+							: node.status;
+				tree.set(node.id, {
+					...node,
+					status,
+					...(override?.phase === undefined ? {} : { phase: override.phase }),
+				});
+			}
+			// Only overrides whose optimistic STATUS has now been superseded are
+			// dropped: the tree row above is the authoritative projection, so keeping
+			// a lifecycle claim around would resurrect it on the next event. `phase`
+			// is not a lifecycle claim and must survive — it carries no
+			// live/dead meaning and has no other source between events.
+			for (const [nodeId, override] of eventOverrides) {
+				if (!tree.has(nodeId)) continue;
+				if (override.status === undefined) continue;
+				const current = tree.get(nodeId);
+				if (current !== undefined && current.status !== override.status) eventOverrides.delete(nodeId);
 			}
 			for (const nodeId of activity.keys()) if (!tree.has(nodeId)) activity.delete(nodeId);
 			for (const nodeId of eventOverrides.keys()) if (!tree.has(nodeId)) eventOverrides.delete(nodeId);
 		}
-		return [...tree.values()].map((node) => ({ ...node }));
+		const nodes = [...tree.values()].map((node) => ({ ...node }));
+		return mergeSpawnModes(nodes);
+	};
+
+	/**
+	 * #209/D5: the arbitrated backend lives on the tracked job, never in
+	 * legion.db (no column, no migration), so it is merged onto the matching
+	 * snapshot. Unmatched jobs contribute nothing rather than a guess.
+	 *
+	 * Shared by `snapshotNodes()` and `treeNodes()`: the latter synthesizes
+	 * nodes of its own (a job with identity but no DB row yet) and returns that
+	 * array directly, so a merge that only ran in `snapshotNodes()` would drop
+	 * the mode in the pre-DB-row window and in a plain session where
+	 * `getTreeNodes()` yields `[]`.
+	 */
+	const mergeSpawnModes = (
+		nodes: TreeNodeSnapshot[],
+	): TreeNodeSnapshot[] => {
+		for (const job of jobs.values()) {
+			if (job.spawnMode === undefined) continue;
+			const match = storedNodeForJob(job, nodes);
+			if (match) match.spawnMode = job.spawnMode;
+		}
+		return nodes;
 	};
 
 	const storedNodeForJob = (
@@ -726,16 +928,29 @@ export function createSessionRuntime(deps: SessionRuntimeDeps): SessionRuntime {
 		const data = event.data && typeof event.data === "object" && !Array.isArray(event.data)
 			? event.data as Record<string, unknown>
 			: undefined;
-		if (node && event.ts >= node.updatedAt) {
+		if (node) {
+			// D3: no cross-writer timestamp race.
+			//
+			// `event.ts` is stamped by THIS process's bus; `node.updatedAt` is stamped
+			// by the CHILD's heartbeat. A dead child stops heartbeating, so its
+			// `updatedAt` freezes and a later real event would fail `event.ts >=
+			// updatedAt` — silently dropped, leaving the panel stuck. Only the
+			// SAME-writer ordering is still meaningful: an event must not undo a
+			// NEWER event from the same bus (that is `previous.ts`, below).
+			//
+			// D8: this is an optimistic update only. `snapshotNodes()` recomputes every
+			// row from facts via `liveness()`, so a stale optimistic status cannot
+			// survive a refresh — which is what makes dropping the clock guard safe.
 			const previous = eventOverrides.get(event.nodeId);
 			if (!previous || event.ts >= previous.ts) {
 				const override = { ...previous, ts: event.ts };
-				const updated = { ...node, updatedAt: event.ts };
+				const updated = { ...node };
 				if (event.type === "node_launched" || event.type === "node_resumed") updated.status = override.status = "running";
 				else if (event.type === "node_settled") updated.status = override.status = "settled";
 				else if (event.type === "node_failed") updated.status = override.status = "failed";
 				else if (event.type === "node_retired" && node.status !== "settled" && node.status !== "failed") updated.status = override.status = "retired";
 				else if (event.type === "node_blocked") updated.status = override.status = "blocked";
+				else if (event.type === "node_abandoned") updated.status = override.status = "failed";
 				else if (event.type === "phase_change" && typeof data?.to === "string") updated.phase = override.phase = data.to;
 				eventOverrides.set(event.nodeId, override);
 				tree.set(event.nodeId, updated);
@@ -761,10 +976,156 @@ export function createSessionRuntime(deps: SessionRuntimeDeps): SessionRuntime {
 		}
 	};
 
+	/**
+	 * True between the first event of a burst and its trailing flush. It is both
+	 * the "a flush is already scheduled" guard and the "a burst is open" marker
+	 * that tells `onWidgetEvent` whether this event needs the leading snapshot.
+	 */
+	let burstPending = false;
+
+	/**
+	 * #238: a burst of bus events in one tick costs ONE tree snapshot + paint
+	 * instead of 2×N. `snapshotNodes()` is a synchronous recursive-CTE subtree
+	 * scan plus a usage batch query, and `refreshUi()` → `statusEntries()` ran it
+	 * a second time per event.
+	 *
+	 * What stays synchronous, per event, in arrival order (D2): `applyTreeEvent`
+	 * is an incremental state machine, not a render. `event.ts >= node.updatedAt`
+	 * lets a later event veto an earlier one, `turn_start` increments the turn and
+	 * clears the frozen endpoint, and `agent_settled` freezes it — so batching or
+	 * reordering these would change the state they compute. They run in the bus
+	 * callback exactly as before.
+	 *
+	 * What is coalesced: the trailing snapshot + paint only. The *leading*
+	 * snapshot is deliberately NOT coalesced: `applyTreeEvent` reads `tree`, which
+	 * only `snapshotNodes()` populates, so the first event of a burst must see a
+	 * current tree or it would project this tick's status/phase delta against
+	 * whatever the previous tick left behind (a node launched since then is simply
+	 * absent, and its event is dropped). A burst therefore costs a leading snapshot
+	 * plus one flush — a constant 2, down from 2×N.
+	 *
+	 * Semantics of the mid-burst window — a DOCUMENTED LIMITATION, not a claim of
+	 * equivalence. Events 2..N are vetted against the tree as of burst start
+	 * instead of being re-read per event (what `master` does).
+	 *
+	 * The divergence class is: ANY mid-burst write that changes a row in this
+	 * subtree. Not just a write to the event's own node — `snapshotNodes()` clears
+	 * and rebuilds the whole `tree` while `eventOverrides` survives, so a sibling
+	 * process committing any row here can change whether a later event's
+	 * `event.ts >= node.updatedAt` guard passes. Reachable in production because
+	 * `getTreeNodes()` re-reads SQLite on every call, so a concurrent writer's
+	 * commit IS visible to a per-event read but not to a burst; sibling bus
+	 * subscribers also read `treeNodes()` inside the burst
+	 * (`legion-commands.ts`).
+	 *
+	 * Sampled rather than exhaustively enumerated: a differential harness over
+	 * burst/row combinations (row status x row `updatedAt` x mid-burst bump x event
+	 * pair) showed the coalesced paint matching a per-event re-read in every case
+	 * with no mid-burst write, and diverging in both directions once there is one —
+	 * the coalesced path can miss a veto `master` applied, and can also apply one
+	 * `master` correctly skipped. So neither "re-read at the flush" nor "re-read at
+	 * burst start" fixes it: reproducing a SEQUENCE of per-event reads is not
+	 * possible with a constant number of reads, which is why this is bounded and
+	 * documented instead of repaired. `test/unit/runtime.test.ts` pins one concrete
+	 * instance (the "KNOWN LIMITATION" test) so the behaviour is asserted rather
+	 * than described.
+	 *
+	 * It IS sticky, and this is not fixed: the override wins on `ts`, exactly as
+	 * `master`'s own override does, so the next `snapshotNodes()` does NOT re-vet it
+	 * away. It lasts until the row moves again. Fixing it needs per-event re-reads,
+	 * i.e. reverting the optimisation.
+	 *
+	 * One sub-case IS closed, at no cost to the common burst: an event for a node
+	 * that is absent from `tree` but belongs to THIS subtree (its row only landed
+	 * mid-burst) takes a fresh snapshot before applying, so `applyTreeEvent`'s
+	 * `tree.get()` miss cannot silently drop it. Foreign-subtree node ids — the
+	 * normal shape of a shared-ledger poll batch — cost zero extra reads.
+	 *
+	 * Microtask, not macrotask: the burst this targets is one synchronous emit
+	 * loop (`legion-tools.ts` emits N `mail_sent` events back-to-back; the db event
+	 * source drains a poll batch the same way), and a microtask drains the whole
+	 * burst with no timer seam, no extra flush API, and no added latency before the
+	 * TUI's next frame. A macrotask would need an explicit `flush()` seam or a
+	 * timer and would delay the paint by a tick for no coalescing benefit.
+	 */
+	/**
+	 * The subtree this runtime renders, derived from the FIRST populated snapshot.
+	 * `snapshotNodes()` calls `deps.getTreeNodes()`, which the extension supplies
+	 * as `getSubtree(db, identity.nodeId)` — so the shallowest node id in that
+	 * result IS this session's subtree root, and every node it can ever show is
+	 * that id or a strict descendant of it (`parent.child`).
+	 *
+	 * This is what bounds the unknown-node snapshot below (#238 review): the
+	 * DbEventSource emits EVERY row on the shared legion.db, so a sibling
+	 * subtree's batch routinely lands on this bus with `nodeId`s this session can
+	 * never render. Paying a snapshot per such event would be backwards — a
+	 * 40-event foreign batch cost 41 reads, worse than master's 80/2 ratio implied.
+	 * `undefined` means "not yet known" (empty tree / a host with no tree), in
+	 * which case an unknown node is treated as possibly-ours and gets the read.
+	 */
+	const subtreeRootId = (): string | undefined => {
+		let best: string | undefined;
+		for (const id of tree.keys()) {
+			if (best === undefined || id.length < best.length) best = id;
+		}
+		return best;
+	};
+
+	/** True when `nodeId` is the subtree root itself or a strict descendant of it. */
+	const isInOwnSubtree = (nodeId: string): boolean => {
+		const rootId = subtreeRootId();
+		if (rootId === undefined) return true;
+		return nodeId === rootId || nodeId.startsWith(`${rootId}.`);
+	};
+
+	const scheduleTreeFlush = (): void => {
+		if (burstPending) return;
+		burstPending = true;
+		queueMicrotask(() => {
+			burstPending = false;
+			// The old inline path ran `refreshUi()` INSIDE the bus handler, so a throw
+			// from `getTreeNodes()`/`board.paint()` was contained by
+			// `createLegionEventBus`'s per-subscriber try/catch. A microtask has no
+			// such wrapper, so an uncaught throw here would kill the host process. The
+			// bus's job is to isolate a subscriber's failure; report through the same
+			// channel a throwing handler uses instead of escaping onto the microtask
+			// queue. No `disposed` guard: `refreshUi()` already returns early when
+			// disposed, and this callback calls no other paint-path code.
+			try {
+				refreshUi();
+			} catch (error) {
+				// Reporting must never itself break delivery, and must never re-enter
+				// the microtask queue as an uncaught throw: `reportError` is optional
+				// precisely so structural bus stand-ins keep working, and such a stand-in
+				// would otherwise reintroduce the host-killing crash this guard exists
+				// to prevent. Swallowing is the lesser evil — a lost repaint report
+				// never costs the process.
+				try {
+					deps.eventBus?.reportError?.(error, "deferred-handler");
+				} catch {
+					// Isolated reporting failure: the board simply skips this frame.
+				}
+			}
+		});
+	};
+
 	const onWidgetEvent = (event: LegionEvent): void => {
-		snapshotNodes();
+		// Leading snapshot, once per burst (see `scheduleTreeFlush`).
+		if (!burstPending) snapshotNodes();
+		// A node whose row only landed mid-burst is absent from `tree`, and
+		// `applyTreeEvent` returns early on a `tree.get()` miss, so the event is
+		// dropped and the flush cannot repair it: a just-launched child's ledger row
+		// still says whatever the pre-launch write left (`starting` or nothing), so
+		// re-reading cannot produce the `running` transition that a STORED
+		// `node_launched` event carries. Pay one snapshot for exactly this case.
+		//
+		// Gated on subtree ownership: foreign-subtree events are the normal shape of
+		// a shared-ledger poll batch and can never create a node here, so they cost
+		// ZERO extra reads. Without the gate a 40-event foreign batch cost 41 reads;
+		// with it, 2 (leading + flush).
+		else if (!tree.has(event.nodeId) && isInOwnSubtree(event.nodeId)) snapshotNodes();
 		applyTreeEvent(event);
-		refreshUi();
+		scheduleTreeFlush();
 	};
 	const busUnsubscribers = deps.eventBus
 		? LEGION_EVENT_TYPES
@@ -776,7 +1137,15 @@ export function createSessionRuntime(deps: SessionRuntimeDeps): SessionRuntime {
 		try {
 			ledgerDb = openLegionDb(process.env.PI_LEGION_DB);
 			snapshotNodes();
+			// Seed at the tail for the same reason as the extension's attach path
+			// (`attachLegionRuntime` in index.ts, #238): this branch attaches to a ledger
+			// written by another process, and replaying its history only to reach a state
+			// `snapshotNodes()` already read is pure overhead. It matters for embedders
+			// using the public `createSessionRuntime` with PI_LEGION_DB and no
+			// `getTreeNodes` — unreachable from the extension itself, which always passes
+			// `getTreeNodes` — so keep the two call sites consistent.
 			dbEventSource = createDbEventSource(ledgerDb, {
+				cursor: maxEventId(ledgerDb),
 				onError: deps.onDbEventSourceError,
 			});
 			if (deps.eventBus) dbEventSource.start(deps.eventBus);
@@ -969,6 +1338,9 @@ export function createSessionRuntime(deps: SessionRuntimeDeps): SessionRuntime {
 				existing.model = input.model;
 				existing.thinking = input.thinking;
 				existing.worktreeBranch = input.worktreeBranch;
+				// Only a known value overwrites: a re-follow without the handle must
+				// not erase the mode an earlier launch established.
+				if (input.spawnMode !== undefined) existing.spawnMode = input.spawnMode;
 				if (input.nodeId !== undefined || identity.nodeId !== undefined) existing.nodeId = input.nodeId ?? identity.nodeId;
 				if (input.parentId !== undefined || identity.parentId !== undefined) existing.parentId = input.parentId ?? identity.parentId;
 				if (input.depth !== undefined || identity.depth !== undefined) existing.depth = input.depth ?? identity.depth;
@@ -1308,7 +1680,10 @@ export function createSessionRuntime(deps: SessionRuntimeDeps): SessionRuntime {
 				if (index >= 0) result[index] = next;
 				else result.push(next);
 			}
-			return result;
+			// The synthesized nodes above are built from job facts, not from a DB
+			// row, so they carry no `spawnMode` of their own: run the same merge
+			// the snapshot path uses before handing the array out (#209/D5).
+			return mergeSpawnModes(result);
 		},
 
 		statusEntries() {
@@ -1412,6 +1787,28 @@ function latestActivityAt(...candidates: Array<number | undefined>): number | un
 	return best;
 }
 
+/**
+ * Resident memory of a tracked job in MB, or `undefined` when there is no
+ * honest number to report (D2).
+ *
+ * Only an `rpc` child owns a process. An `inprocess` child runs inside this
+ * host, so it has no RSS of its own: apportioning the host figure across
+ * children would invent data the user then decides on. Those rows stay blank
+ * and the host figure is reported once, by name, elsewhere.
+ *
+ * §6 pid-reuse race: a pid outlives nothing — once the child exits, the kernel
+ * may hand the same number to an unrelated process, and its RSS would land on
+ * this row as the child's memory. So the pid is only read while the caller's
+ * liveness check says the child is still up; a job with no `isAlive` hook
+ * (legacy / re-followed record) has unverifiable liveness and stays blank too.
+ */
+function rssFor(job: TrackedJob): number | undefined {
+	if (job.spawnMode === "inprocess" || job.pid === undefined) return undefined;
+	// `isAlive` undefined is not permission to read: unknown is not alive.
+	if (!job.isAlive || !job.isAlive()) return undefined;
+	return readProcRss(job.pid)?.rssMb;
+}
+
 function statusEntryFromJob(
 	job: TrackedJob,
 	identity?: LegionTreeIdentity,
@@ -1429,6 +1826,7 @@ function statusEntryFromJob(
 				: executionStatus === "failed" || executionStatus === "truncated" || executionStatus === undefined ? "failed"
 					: "retired";
 	const finishedAt = terminalNode ? node.updatedAt : job.settledAt;
+	const rss = rssFor(job);
 	const lastActivityAt = latestActivityAt(
 		node?.updatedAt,
 		live.currentTurnStartedAt,
@@ -1461,6 +1859,10 @@ function statusEntryFromJob(
 			? { tokensOut: live.tokensOut }
 			: node?.tokensOut ? { tokensOut: node.tokensOut } : {}),
 		...(live.generationMs ? { generationMs: live.generationMs } : {}),
+		...(live.contextTokens ? { contextTokens: live.contextTokens } : {}),
+		...(job.pid ? { pid: job.pid } : {}),
+		...(job.spawnMode ? { spawnMode: job.spawnMode } : {}),
+		...(rss !== undefined ? { rss } : {}),
 		...(lastActivityAt !== undefined ? { lastActivityAt } : {}),
 		...(identity ? {
 			nodeId: identity.nodeId,
@@ -1497,9 +1899,11 @@ function statusEntryFromNode(
 		...(node.phase ? { phase: node.phase } : {}),
 		...(node.kind ? { kind: node.kind } : {}),
 		...(node.model ? { model: node.model } : {}),
+		...(node.spawnMode ? { spawnMode: node.spawnMode } : {}),
 		...(live.usageTotal ? { tokensTotal: live.usageTotal } : node.tokensTotal ? { tokensTotal: node.tokensTotal } : {}),
 		...(tokensOut ? { tokensOut } : {}),
 		...(live.generationMs ? { generationMs: live.generationMs } : {}),
+		...(live.contextTokens ? { contextTokens: live.contextTokens } : {}),
 		...(activity?.turn !== undefined ? { turns: activity.turn } : {}),
 		...(activity?.turnStartedAt !== undefined ? { currentTurnStartedAt: activity.turnStartedAt } : {}),
 		...(activity?.turnEndedAt !== undefined ? { currentTurnEndedAt: activity.turnEndedAt } : {}),

package/src/extension/slash.ts

@@ -14,7 +14,6 @@ import type {
 } from "../shared/types.ts";
 import { classifyModelOrigin, resolveStepModel } from "../agents/step-model.ts";
 import { checkModelScope } from "../agents/model-scope.ts";
-import { nativeModelFor } from "../runs/kind.ts";
 import {
 	DEFAULT_TEAM,
 	TEAM_ENV,
@@ -199,7 +198,6 @@ function renderOneAgent(
 	lines.push(`    ${agent.description}`);
 
 	const details: string[] = [];
-	if (agent.kind !== "pi") details.push(`kind=${agent.kind}`);
 	if (agent.alias?.length) details.push(`alias: ${agent.alias.join(", ")}`);
 
 	// Model resolution mirrors the launch path (resolveStepModel) so the line
@@ -247,9 +245,6 @@ function renderOneAgent(
  *     params are empty).
  *   - `checkModelScope` — an out-of-scope model is flagged exactly like
  *     `launchStep` would flag it (error-severity for explicit models).
- *   - `nativeModelFor` — a model the target kind cannot express is either a
- *     launch refusal (explicit origin, mirroring `planModelCandidates`) or a
- *     documented drop to the CLI's own default (inherited origin).
  */
 function modelLine(
 	agent: AgentConfig,
@@ -275,22 +270,6 @@ function modelLine(
 		);
 	}
 
-	// Kind/model coherence: a model the target CLI cannot express.
-	if (agent.kind !== "pi") {
-		const native = nativeModelFor(agent.kind, model, agent.thinking);
-		if (native === undefined) {
-			if (origin === "explicit") {
-				parts.push(
-					`✗ cannot be used with kind '${agent.kind}' — a launch would refuse this`,
-				);
-			} else {
-				parts.push(
-					`dropped at launch: kind '${agent.kind}' runs on its own default`,
-				);
-			}
-		}
-	}
-
 	return parts.join(" · ");
 }