Never Restart (agents that survive an update)

What it is

Today, updating Omniscio means quitting it. Quitting ends every session, and the app then brings them back one by one, minutes apart — measured at 8–12 minutes for a dozen sessions and well over an hour for a large fleet. That wait is the pain this work removes.

Never Restart splits the app in two. A thin shell owns the window, the tray, the menus and the shortcuts and is what you see. A backend owns the database, the schedules and the sessions and can be replaced. The agents' pipes are held by a small helper that outlives both, so a new backend can pick up a conversation that never stopped. You get:

• No restart to update. New backend code is built into a fresh folder and swapped in behind the window.
• Agents that keep working. An agent started the new way keeps its identity, its output and its place in a conversation across a swap.
• A screen that waits for you. New interface code waits behind a "Reload interface" button; it never refreshes under your hands.
• Honesty after a crash. If the backend dies unexpectedly, the agent's process is kept alive but the session is held and labelled, because Omniscio cannot prove the conversation is intact. You get Stop, or "Start fresh from here".

Where to find it

Nothing is visible yet. When it ships, the pieces will be:

• An Apply updates action, offered where the app currently asks you to restart.
• A small Reload interface chip when a change only affects the screen.
• A status line on each session saying whether it is restart-safe.
• On a session that was held after a crash, the recovery wording described above with its two buttons.

Until then, updating Omniscio still restarts it, exactly as it always has.

How it behaves

• Applying an update never closes the window. The app builds the new code in a new folder and checks it can work with your current data before starting it. If it cannot, it tells you a full restart is needed rather than trying anyway.
• Only agents born the new way are protected. Sessions already running when this arrives keep today's behaviour until they finish; the app never pretends to have rescued an older one.
• A crash is not a recovery. After an unexpected backend death the agent keeps running, but Omniscio stops sending it anything — no new turns, no permission replies, no billing replay — until it can prove, through the agent's own protocol, that the conversation is consistent. Until then the session is marked held, and the message says part of the conversation was lost to Omniscio.
• A running agent is never announced as finished if its last output was cut off. If something the agent started keeps the output open, the session says its output was incomplete and holds back the usual "done" notices.
• Quitting still ends everything. A full quit stops your agents and rotates their credentials, as it does today. A backend update or an ordinary restart does not.

Status: in development, and off by default. The first version ships behind one setting, and it becomes the normal behaviour only after the full set of restart tests passes. With the setting off, Omniscio behaves exactly as it does today.

For agents

The rules that must hold live in the never-restart contract, and the wiring plan is in its map. The parts this page describes are not in the codebase yet: the launch host keeps the pipe ends today only for the length of one app run, the backend is the same process as the window, and the agent-token secret is regenerated on every start.

Related

• Crash recovery — what happens today when a session dies, and how it comes back.
• Bulk stop and restart sessions — the manual controls you have now.
• App update notifications — how the app updates itself today, and why it asks to restart.
• CLI session recovery — bringing a session back from the command line.