rubino-agent 0.3.0 → 0.5.0

data/lib/rubino/documents/converters/pdf.rb

@@ -29,14 +29,23 @@ module Rubino
           File.extname(path.to_s).downcase == ".pdf"
         end
 
-        def convert(path)
+        def convert(path, budget = Limits.null_budget)
           require "pdf/reader"
           reader = PDF::Reader.new(path)
-          pages = reader.pages.map { |page| page_text(page) }
+          pages = []
+          # budget.tick per page bails a page bomb DURING extraction, and the
+          # accumulated-bytes cap bounds a single pathologically dense page.
+          reader.pages.each do |page|
+            txt = page_text(page)
+            budget.tick(bytes: txt.bytesize)
+            pages << txt
+          end
           text = pages.reject(&:empty?).join("\n\n")
           return scanned_note if text.strip.empty?
 
           text
+        rescue Rubino::Interrupted, CapExceeded
+          raise
         rescue PDF::Reader::MalformedPDFError, PDF::Reader::UnsupportedFeatureError
           scanned_note
         end

data/lib/rubino/documents/converters/plain.rb

@@ -42,8 +42,9 @@ module Rubino
           MARKDOWN_EXTS.include?(ext) || LANGS.key?(ext)
         end
 
-        def convert(path)
+        def convert(path, budget = Limits.null_budget)
           raw = File.binread(path).to_s.dup.force_encoding("UTF-8")
+          budget.add_bytes(raw.bytesize)
           raw = raw.scrub("�") unless raw.valid_encoding?
           ext = File.extname(path.to_s).downcase
 

data/lib/rubino/documents/converters/pptx.rb

@@ -26,10 +26,19 @@ module Rubino
           File.extname(path.to_s).downcase == ".pptx"
         end
 
-        def convert(path)
+        def convert(path, budget = Limits.null_budget)
           require "ruby_powerpoint"
+          # PRE-OPEN guard against a slide/text zip-expand bomb (see Docx). Sum
+          # EVERY entry under ppt/ -- including a bomb hidden at a nested/non-
+          # standard path behind a .rels Target. `ppt/**` matches across `/`
+          # (guard_zip! globs without FNM_PATHNAME) so a deep bomb is caught (#337).
+          Limits.guard_zip!(path, budget, ["ppt/**"])
           ppt = RubyPowerpoint::Presentation.new(path)
-          parts = ppt.slides.each_with_index.map { |slide, i| slide_markdown(slide, i + 1) }
+          parts = ppt.slides.each_with_index.map do |slide, i|
+            md = slide_markdown(slide, i + 1)
+            budget.tick(bytes: md.to_s.bytesize)
+            md
+          end
           parts.compact.join("\n\n")
         end
 

data/lib/rubino/documents/converters/xlsx.rb

@@ -30,10 +30,26 @@ module Rubino
           EXTS.include?(File.extname(path.to_s).downcase)
         end
 
-        def convert(path)
+        # OpenDocument (ODS) body globs: roo reads `content.xml` at the archive
+        # ROOT (and may touch other root *.xml like styles.xml/meta.xml) -- NOT
+        # under xl/. Scoping the pre-open guard to xl/** alone let an ODS bomb sum
+        # to zero and slip to inflate (#350); we add the root XML read paths.
+        ODS_GLOBS = ["content.xml", "*.xml"].freeze
+        # OOXML (xlsx) body parts live under xl/ (across `/`, no FNM_PATHNAME).
+        XLSX_GLOBS = ["xl/**"].freeze
+
+        def convert(path, budget = Limits.null_budget)
           require "roo"
+          # PRE-OPEN guard: a 400k-row spreadsheet expands its sheet/content XML
+          # far past the on-disk cap. Sum the uncompressed sizes of the body
+          # entries (and any nested/non-standard part a bomb could hide behind a
+          # .rels Target) from the central directory and bail before roo inflates
+          # them. Globs match across `/` (guard_zip! omits FNM_PATHNAME) so a deep
+          # bomb is summed too (#337); the glob set is chosen per format so an ODS
+          # bomb rooted at content.xml is also caught (#350).
+          Limits.guard_zip!(path, budget, zip_globs(path))
           book = Roo::Spreadsheet.open(path)
-          parts = book.sheets.map { |name| sheet_markdown(book, name) }.compact
+          parts = book.sheets.map { |name| sheet_markdown(book, name, budget) }.compact
           parts.join("\n\n")
         ensure
           book&.close if defined?(book) && book.respond_to?(:close)
@@ -41,18 +57,33 @@ module Rubino
 
         private
 
-        def sheet_markdown(book, name)
+        # Read-path globs for the pre-open zip-bomb guard, by format. ODS keeps
+        # its body at the archive root (content.xml + sibling *.xml), so the
+        # xl/** OOXML scope would miss its bomb (#350). The whole-archive backstop
+        # in guard_zip! bounds anything these globs don't, but scoping correctly
+        # keeps the tight body cap doing the real work.
+        def zip_globs(path)
+          File.extname(path.to_s).downcase == ".ods" ? ODS_GLOBS : XLSX_GLOBS
+        end
+
+        def sheet_markdown(book, name, budget = Limits.null_budget)
           sheet = book.sheet(name)
           rows = []
           if sheet.first_row && sheet.last_row
+            # budget.tick per row bails a 400k-row bomb DURING extraction --
+            # before roo materialises every cell into memory.
             (sheet.first_row..sheet.last_row).each do |r|
-              rows << (sheet.first_column..sheet.last_column).map { |c| sheet.cell(r, c) }
+              cells = (sheet.first_column..sheet.last_column).map { |c| sheet.cell(r, c) }
+              budget.tick(bytes: cells.sum { |c| c.to_s.bytesize })
+              rows << cells
             end
           end
           table = Table.emit(rows)
           return nil if table.empty?
 
           "## #{name}\n\n#{table}"
+        rescue Rubino::Interrupted, CapExceeded
+          raise
         rescue StandardError
           nil
         end

data/lib/rubino/documents/converters/xml.rb

@@ -20,8 +20,9 @@ module Rubino
           File.extname(path.to_s).downcase == ".xml"
         end
 
-        def convert(path)
+        def convert(path, budget = Limits.null_budget)
           raw = File.read(path, encoding: "bom|utf-8")
+          budget.add_bytes(raw.bytesize)
           pretty = pretty_print(raw) || raw.strip
           "```xml\n#{pretty}\n```\n"
         end

data/lib/rubino/documents/limits.rb

@@ -0,0 +1,210 @@
+# frozen_string_literal: true
+
+module Rubino
+  module Documents
+    # Shared decompression-bomb / runaway-conversion guard for the in-process
+    # converters (#S4-1). The 25 MB on-disk `max_file_bytes` is trivially
+    # defeated by zip compression: a 100 KB .docx expands to 34 MB of XML and
+    # ~1M paragraphs, driving rubino to ~1.4 GB RSS / ~100 s of uninterruptible
+    # CPU before the output cap (applied only AFTER full conversion) throws the
+    # result away. The fix caps BEFORE/DURING conversion.
+    #
+    # A Budget is created once per conversion and threaded into the converter's
+    # per-element loop. Each iteration calls #tick(elements:, bytes:), which:
+    #   - honors the cancel_token (raises Rubino::Interrupted so the turn is
+    #     interruptible mid-conversion, not just at chunk boundaries);
+    #   - enforces an element/page/row count ceiling (paragraphs, rows, pages,
+    #     slides) so a structural bomb stops after N units;
+    #   - enforces a decompressed-bytes ceiling (accumulated extracted/parsed
+    #     text) so an expand bomb stops once it has produced a few x the output
+    #     cap of text;
+    #   - enforces a wall-clock budget so any pathological slow path (a single
+    #     huge element, a quadratic gem call) still bails in bounded time.
+    # On any ceiling, it raises CapExceeded -> shell-hint. All caps are
+    # generous relative to a real document but tiny relative to a bomb.
+    module Limits
+      module_function
+
+      # Defaults. Overridable via config (attachments.policy.convert_*), so an
+      # operator can loosen them, but the secure defaults bound a bomb hard.
+      #   - MAX_ELEMENTS: paragraphs/rows/pages/slides processed before bail.
+      #   - MAX_DECOMPRESSED_BYTES: accumulated extracted text bytes; ~5 MB is
+      #     ~50 x the 100 KB inline budget and far below the 34 MB an expand
+      #     bomb produces.
+      #   - WALL_CLOCK_SECONDS: total conversion budget.
+      #   - TICK_INTERVAL: how often (in elements) to read the clock, so the
+      #     time check itself is cheap in the hot loop.
+      DEFAULT_MAX_ELEMENTS         = 50_000
+      DEFAULT_MAX_DECOMPRESSED     = 5_000_000 # ~5 MB of extracted text
+      DEFAULT_WALL_CLOCK_SECONDS   = 15.0
+      TICK_INTERVAL                = 256
+
+      # PRE-OPEN zip-bomb guard for the OOXML converters (docx/xlsx/pptx). The
+      # decisive cost of a zip-expand bomb is paid the instant the gem opens the
+      # file: it reads the (e.g. 34 MB) decompressed XML entry into a String and
+      # builds the full Nokogiri DOM (~1.4 GB RSS) BEFORE yielding a single
+      # paragraph -- so per-element ticking alone is too late. The central
+      # directory carries each entry's UNCOMPRESSED size, readable without
+      # decompressing, so we sum the relevant XML entries first and bail to the
+      # shell-hint before the gem inflates anything.
+      #
+      # The sum runs WITHOUT File::FNM_PATHNAME so `*` crosses `/` -- a bomb
+      # planted at a nested, non-standard path (e.g. xl/worksheets/deep/sheet.xml,
+      # reachable via the workbook .rels Target, or ppt/slides/extra/s.xml) is
+      # caught just like one at the canonical depth. The pre-fix glob used
+      # FNM_PATHNAME, so `*` stopped at `/` and a deep bomb summed to zero and
+      # slipped through to roo's inflate (#337). Globs still scope the sum to the
+      # body parts (word/document*.xml, xl/**, ppt/**) so a large thumbnail/media
+      # blob doesn't false-positive. Raises CapExceeded over cap.
+      #
+      # #350: scoping to the OOXML body globs alone missed formats whose read
+      # paths live OUTSIDE that prefix -- notably an ODS, whose `content.xml`
+      # sits at the archive ROOT (not under xl/) yet is routed through the same
+      # roo/xlsx converter. Such a bomb summed to ZERO under `xl/**` and slipped
+      # to roo's inflate. The converter now passes the ACTUAL read-path globs per
+      # format (ODS adds `content.xml`/root `*.xml`). As a backstop we ALSO sum
+      # the WHOLE archive's uncompressed bytes against a (looser) total cap, so a
+      # bomb at any unforeseen path is still bounded even if no body glob matches
+      # it. The two caps are independent: the per-glob sum keeps the body tight,
+      # the whole-archive backstop guarantees no out-of-glob path is unbounded.
+      def guard_zip!(path, budget, globs)
+        require "zip"
+        scoped = 0
+        archive = 0
+        archive_cap = total_archive_cap(budget)
+        Zip::File.open(path) do |zip|
+          zip.each do |entry|
+            size = entry.size.to_i
+            archive += size
+            if archive > archive_cap
+              raise CapExceeded, "decompressed zip size cap (whole-archive #{archive_cap} bytes) exceeded"
+            end
+
+            # No FNM_PATHNAME: `*` matches across `/` so nested-path bombs sum.
+            next unless globs.any? { |g| File.fnmatch?(g, entry.name) }
+
+            scoped += size
+            if scoped > budget.max_decompressed_bytes
+              raise CapExceeded, "decompressed zip size cap (#{budget.max_decompressed_bytes} bytes) exceeded"
+            end
+          end
+        end
+      rescue CapExceeded
+        raise
+      rescue StandardError
+        # A malformed/unreadable zip is not our concern here -- let the gem-level
+        # converter handle it (it degrades to nil/shell-hint). Don't block a
+        # valid file because the pre-check tripped on an exotic zip layout.
+        nil
+      end
+
+      # Whole-archive backstop cap (#350). Looser than the per-glob body cap so a
+      # legit doc with large media/thumbnails the converter never reads doesn't
+      # false-positive, but still finite so an out-of-glob bomb can't be
+      # unbounded. Defaults to ARCHIVE_CAP_MULTIPLIER x the body cap (∞ stays ∞).
+      ARCHIVE_CAP_MULTIPLIER = 20
+
+      def total_archive_cap(budget)
+        body = budget.max_decompressed_bytes
+        return body if body == Float::INFINITY
+
+        body * ARCHIVE_CAP_MULTIPLIER
+      end
+
+      # A no-op budget for direct converter calls / tests that don't thread a
+      # real budget. Caps are effectively unbounded but cancellation still
+      # works if a token is supplied.
+      def null_budget
+        Budget.new(
+          max_elements: Float::INFINITY,
+          max_decompressed_bytes: Float::INFINITY,
+          wall_clock_seconds: Float::INFINITY
+        )
+      end
+
+      # Builds a Budget from config, falling back to the secure defaults.
+      def budget(cancel_token: nil)
+        cfg = policy_config
+        Budget.new(
+          max_elements: int(cfg["convert_max_elements"], DEFAULT_MAX_ELEMENTS),
+          max_decompressed_bytes: int(cfg["convert_max_decompressed_bytes"], DEFAULT_MAX_DECOMPRESSED),
+          wall_clock_seconds: flt(cfg["convert_wall_clock_seconds"], DEFAULT_WALL_CLOCK_SECONDS),
+          cancel_token: cancel_token
+        )
+      end
+
+      def policy_config
+        Rubino.configuration.dig("attachments", "policy") || {}
+      rescue StandardError
+        {}
+      end
+
+      def int(value, default)
+        value.nil? ? default : Integer(value)
+      rescue ArgumentError, TypeError
+        default
+      end
+
+      def flt(value, default)
+        value.nil? ? default : Float(value)
+      rescue ArgumentError, TypeError
+        default
+      end
+
+      # Per-conversion resource counter. Not thread-safe by design: a single
+      # conversion runs on one thread; the cancel_token IS the cross-thread
+      # signal and is itself lock-free/monotonic.
+      class Budget
+        attr_reader :elements, :bytes, :max_decompressed_bytes
+
+        def initialize(max_elements:, max_decompressed_bytes:, wall_clock_seconds:, cancel_token: nil)
+          @max_elements = max_elements
+          @max_decompressed_bytes = max_decompressed_bytes
+          @wall_clock = wall_clock_seconds
+          @deadline = monotonic + wall_clock_seconds
+          @cancel_token = cancel_token
+          @elements = 0
+          @bytes = 0
+          @since_clock = 0
+        end
+
+        # Account for one (or more) processed units and `bytes` of extracted
+        # text, then enforce every cap. Call once per element in the converter's
+        # hot loop. Raises Rubino::Interrupted on cancel, CapExceeded on any cap.
+        def tick(elements: 1, bytes: 0)
+          @elements += elements
+          @bytes += bytes
+          @since_clock += elements
+
+          # Cancellation first: a cancelled turn must abort even mid-bomb.
+          raise Rubino::Interrupted if @cancel_token&.cancelled?
+
+          raise CapExceeded, "element count cap (#{@max_elements}) exceeded" if @elements > @max_elements
+          if @bytes > @max_decompressed_bytes
+            raise CapExceeded, "decompressed size cap (#{@max_decompressed_bytes} bytes) exceeded"
+          end
+
+          # Reading a clock per element is measurable in a tight 1M-iteration
+          # loop; sample it every TICK_INTERVAL elements instead.
+          return unless @since_clock >= TICK_INTERVAL
+
+          @since_clock = 0
+          raise CapExceeded, "wall-clock budget (#{format("%.0f", @wall_clock)}s) exceeded" if monotonic > @deadline
+        end
+
+        # Account for `count` extracted bytes WITHOUT advancing the element count
+        # (e.g. a raw whole-file read in html/csv/json/xml/plain). Still checks
+        # the byte ceiling, the clock, and cancellation.
+        def add_bytes(count)
+          tick(elements: 0, bytes: count)
+        end
+
+        private
+
+        def monotonic
+          Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        end
+      end
+    end
+  end
+end

data/lib/rubino/documents.rb

@@ -29,14 +29,21 @@ module Rubino
     # the file (unknown format, or the format's optional gem isn't installed, or
     # extraction produced nothing). Never raises -- a converter failure degrades
     # to nil so the caller emits the actionable shell-hint.
-    def to_markdown(path, mime: nil)
+    def to_markdown(path, mime: nil, cancel_token: nil)
       converter = Registry.for(mime: mime, path: path)
       return nil unless converter
 
-      out = converter.convert(path)
+      budget = Limits.budget(cancel_token: cancel_token)
+      out = converter.convert(path, budget)
       out = out.to_s
       out.strip.empty? ? nil : out
-    rescue LoadError, StandardError
+    rescue Rubino::Interrupted
+      # A cancelled turn must propagate so the run aborts cleanly; do NOT
+      # swallow it into the nil/shell-hint degrade path.
+      raise
+    rescue CapExceeded, LoadError, StandardError
+      # Decompression bomb / runaway / missing gem / extraction failure all
+      # degrade to nil so the caller emits the actionable shell-hint.
       nil
     end
 

data/lib/rubino/errors.rb

@@ -19,6 +19,24 @@ module Rubino
   # Domain errors (ConfigurationError, DatabaseError, SessionError, ToolError,
   # CompactionError, JobError) also subclass Error and live in lib/rubino.rb.
 
+  module Database
+    # Raised when a DB connection can't be established because a peer held the
+    # write lock past the bounded retry budget — a SUSTAINED concurrent-migration
+    # contention (#333/#359). Reopened with its full rationale in
+    # database/connection.rb, but DEFINED here, in the always-`require`d
+    # errors.rb, on purpose: `CLI::Commands.start` rescues this constant as its
+    # final boot-lock backstop (#445), and database/connection.rb is LAZILY
+    # autoloaded (only once `Rubino.database` is first touched). For any error
+    # that reaches that rescue BEFORE the DB is opened — an unknown subcommand, a
+    # bad flag, an empty prompt, a config-set validation error — Ruby would
+    # otherwise evaluate the rescue's class expression against an UNLOADED
+    # constant and raise `NameError: uninitialized constant
+    # Rubino::Database::BusyError`, masking the real (often clean Thor) error
+    # with a ~60-line backtrace. Defining it eagerly here keeps the rescue inert
+    # for non-DB errors while still catching a genuine concurrent-boot BusyError.
+    class BusyError < StandardError; end
+  end
+
   # Resource not found. Maps to 404.
   #
   # @param resource [String, Symbol] resource type (e.g. "Session", :run)
@@ -60,12 +78,25 @@ module Rubino
     end
   end
 
-  # User interrupted an in-progress LLM turn (Esc / Ctrl+C in the chat TUI).
-  # Caught by the Loop/Lifecycle so partial content can still be persisted
-  # and the UI can return to a ready state cleanly.
+  # An in-progress LLM turn was aborted. +reason+ distinguishes a deliberate
+  # user interrupt (Esc / Ctrl+C in the chat TUI — :user) from an EXTERNAL
+  # teardown (SIGTERM/SIGHUP from systemd, a terminal close, or a supervisor
+  # kill — :external). Both are caught by the Loop/Lifecycle so partial content
+  # can still be persisted and the UI returns to a ready state cleanly, but the
+  # result LABEL must not claim "interrupted by user" when no user interrupted
+  # (#361b). Default stays :user with the historical message for compatibility.
   class Interrupted < Error
-    def initialize(message = "interrupted by user")
-      super
+    attr_reader :reason
+
+    def initialize(message = nil, reason: :user)
+      @reason = reason
+      super(message || default_message(reason))
+    end
+
+    private
+
+    def default_message(reason)
+      reason == :external ? "interrupted by external signal" : "interrupted by user"
     end
   end
 

data/lib/rubino/interaction/cancel_token.rb

@@ -20,11 +20,24 @@ module Rubino
     # made the chat trap raise ThreadError, the flag never flipped, and the
     # turn ran on. Keep this lock-free and trap-safe.
     class CancelToken
+      # Why the turn was cancelled — distinguishes a deliberate user interrupt
+      # (Esc / Ctrl+C) from an EXTERNAL teardown (SIGTERM/SIGHUP from systemd,
+      # a terminal close, or a supervisor kill). Both unwind the turn the same
+      # way, but the result LABEL must not claim "interrupted by user" when no
+      # user interrupted (#361b). Defaults to :user — the overwhelmingly common
+      # case and the one the historical message described.
+      attr_reader :reason
+
       def initialize
         @cancelled = false
+        @reason = :user
       end
 
-      def cancel!
+      # +reason+ records WHY: :user (Esc/Ctrl+C, default) or :external
+      # (SIGTERM/SIGHUP teardown). One-shot like @cancelled — the first reason
+      # wins, so a later cancel! can't relabel a genuine user interrupt.
+      def cancel!(reason: :user)
+        @reason = reason unless @cancelled
         @cancelled = true
       end
 
@@ -34,9 +47,12 @@ module Rubino
 
       # Raises Interrupted if the token has been cancelled. Used as a poll
       # point inside hot loops (per-chunk in streams, per-iteration in the
-      # agent loop).
+      # agent loop). The Interrupted carries a reason-appropriate message so an
+      # external-signal teardown is not mislabeled as a user interrupt (#361b).
       def check!
-        raise Rubino::Interrupted if cancelled?
+        return unless cancelled?
+
+        raise Rubino::Interrupted.new(reason: @reason)
       end
     end
   end

data/lib/rubino/interaction/events.rb

@@ -31,6 +31,11 @@ module Rubino
       # Context events
       PROMPT_ASSEMBLED = :prompt_assembled
       CONTEXT_BUDGET_CHECKED = :context_budget_checked
+      # The per-turn tool-iteration budget was extended at the cap because the
+      # user chose "Continue (+N)" at the interactive budget-extension prompt
+      # (#399). The turn resumes with full context. Payload:
+      # { iteration:, granted:, new_cap: }.
+      BUDGET_EXTENDED = :budget_extended
 
       # Compression events
       COMPRESSION_STARTED = :compression_started
@@ -96,6 +101,14 @@ module Rubino
       # (currently AttachFileTool). Payload: { path:, filename:,
       # content_type:, byte_size: }.
       ARTIFACT_CREATED = :artifact_created
+
+      # Harness diagnostic, not model answer (#418). Fired when the #381
+      # pessimistic-summary reconciliation detects the model claimed it did
+      # nothing while the tool-call ledger shows work ran. Routed here (and to
+      # stderr) — never into the text answer — so JSON/SSE consumers can carry
+      # it as metadata without polluting `--output-format text` stdout.
+      # Payload: { note: }.
+      HARNESS_NOTE = :harness_note
     end
   end
 end

data/lib/rubino/interaction/lifecycle.rb

@@ -5,10 +5,20 @@ module Rubino
     # Orchestrates the full lifecycle of a single user interaction.
     # Coordinates all phases from input to final response and post-turn jobs.
     class Lifecycle
+      # The session this lifecycle is currently bound to. Starts as the session
+      # passed in, but an automatic budget-triggered compaction swaps it to the
+      # compaction child (see #check_and_compact). The owning Runner reads this
+      # back after #execute so the NEXT turn runs on the (small) child rather
+      # than re-compacting the dead parent every turn (P3 F1). Defined as a
+      # method (not attr_reader) because @session is REASSIGNED on compaction.
+      def active_session
+        @session
+      end
+
       def initialize(session:, event_bus:, ui:, config:, ignore_rules: false,
                      agent_definition: nil, cancel_token: nil,
                      model_override: nil, provider_override: nil,
-                     max_tool_iterations: nil)
+                     max_tool_iterations: nil, polishing: nil)
         @session = session
         @event_bus = event_bus
         @ui = ui
@@ -18,6 +28,12 @@ module Rubino
         @cancel_token = cancel_token
         @model_override = model_override
         @provider_override = provider_override
+        # The Runner-owned detached post-turn polishing worker (#319). When
+        # given, the post-turn jobs are handed to it to drain OFF the live
+        # turn's critical path so the next prompt is never gated. Nil on the
+        # API/server path and nested subagent runs, which keep the original
+        # synchronous inline drain (no interactive prompt to free up).
+        @polishing = polishing
         # Explicit per-run cap from `--max-turns` (Runner → here → IterationBudget).
         # nil ⇒ use the configured agent_max_tool_iterations (#141).
         @max_tool_iterations = max_tool_iterations
@@ -173,17 +189,43 @@ module Rubino
         )
 
         if budget.needs_compaction?(messages)
+          compressor = Context::Compressor.new(session_id: @session[:id])
+
+          # Anti-thrash back-off (#415a): if the last two compactions in this
+          # lineage each saved <10%, skip the paid summary call this turn —
+          # the session is hovering at the threshold and re-compacting would
+          # only shave a message or two. The user can still force /compact.
+          return messages if compressor.thrashing?
+
           @state.transition_to!(:compressing_context, event_bus: @event_bus)
           @ui.compression_started
           @event_bus.emit(Events::COMPRESSION_STARTED, session_id: @session[:id])
 
-          compressor = Context::Compressor.new(session_id: @session[:id])
           result = compressor.compact!
 
           @event_bus.emit(Events::COMPRESSION_FINISHED, **result)
           @ui.compression_finished(result)
 
-          # Reload messages after compaction
+          # Swap the active session to the compaction child (F1). compact!
+          # wrote head+summary+tail into a fresh child and marked THIS parent
+          # status="compacted" — exactly the swap the manual /compact path
+          # performs (chat_command.rb: result[:compact_into] → build_runner on
+          # the child). The automatic path used to skip this, so the turn's
+          # response, update_session_state, and the post-turn jobs all stayed
+          # bound to the now-dead parent: it never shrank, needs_compaction?
+          # stayed permanently true, and the gem re-compacted EVERY subsequent
+          # turn (superlinear DB/context bloat + ~2.9x slowdown). Reassigning
+          # @session to the child means subsequent turns persist to the small
+          # child and compaction fires only once per genuine threshold-cross.
+          # Guard against a no-op compaction (too few messages / empty middle),
+          # which creates no child and returns no target — keep the parent then.
+          child_id = result[:target_session_id]
+          if child_id
+            child = @session_repo.find(child_id)
+            @session = child if child
+          end
+
+          # Reload messages after compaction (from the now-active session)
           assembler = Context::PromptAssembler.new(
             session: @session,
             memory_context: {},
@@ -210,7 +252,10 @@ module Rubino
           # force a redundant re-read + a second approval round-trip. The
           # gate itself still re-prompts on any on-disk change.
           read_tracker: Tools::ReadTracker.for_session(@session[:id]),
-          event_bus: @event_bus
+          event_bus: @event_bus,
+          # Attributes audit rows to this session so the tool_calls FK is
+          # satisfied and the table actually fills (#262).
+          session_id: @session[:id]
         )
 
         # Dispatch through AdapterFactory so a "fake/..." model id (or an
@@ -267,10 +312,26 @@ module Rubino
 
       def enqueue_post_turn_jobs
         queue = Jobs::Queue.new
-
-        # Extract memory if enabled
-        if @config.memory_auto_extract?
-          queue.enqueue("ExtractMemoryJob", { session_id: @session[:id] })
+        # When a detached polishing worker is wired (interactive CLI), only
+        # PERSIST the rows here and let that worker drain them off the live
+        # turn's critical path (#319). Without one (API/server, subagent) keep
+        # the original behaviour: in inline mode #enqueue drains synchronously.
+        drain_inline = @polishing.nil?
+
+        # Turn index for the throttle gates below: message_count grows by a
+        # fixed 2 per completed turn (persist_user_message + update_session_state),
+        # so this is a deterministic, monotonic per-session turn counter — no new
+        # column needed (#412/#414).
+        turn_no = current_turn_index
+
+        # Extract memory if enabled — THROTTLED to ~every N turns (Hermes'
+        # nudge_interval) instead of every turn (#412). `drain_inline` is already
+        # false on the interactive CLI (a polishing worker drains it OFF the live
+        # turn's critical path); it is only true in API/server/subagent contexts
+        # that have no background drainer, so the throttle keeps the aux-LLM
+        # extract off the interactive path AND cuts its cadence ~10x.
+        if @config.memory_auto_extract? && interval_due?(turn_no, @config.memory_auto_extract_interval)
+          queue.enqueue("ExtractMemoryJob", { session_id: @session[:id] }, drain_inline: drain_inline)
           @event_bus.emit(Events::JOB_ENQUEUED, type: "ExtractMemoryJob")
         end
 
@@ -282,17 +343,42 @@ module Rubino
         # already covered) before spending one aux-model call. Handler lookup
         # is load-order independent: Jobs::Registry resolves the class from
         # the Handlers namespace on demand (#81).
-        if @config.skills_auto_distill?
-          queue.enqueue("DistillSkillJob", { session_id: @session[:id] })
+        if @config.skills_auto_distill? && interval_due?(turn_no, @config.skills_auto_distill_interval)
+          queue.enqueue("DistillSkillJob", { session_id: @session[:id] }, drain_inline: drain_inline)
           @event_bus.emit(Events::JOB_ENQUEUED, type: "DistillSkillJob")
         end
 
         # Summarize if session is getting long
         message_count = @message_store.count(@session[:id])
-        return unless message_count > 20
+        if message_count > 20
+          queue.enqueue("SummarizeSessionJob", { session_id: @session[:id] }, drain_inline: drain_inline)
+          @event_bus.emit(Events::JOB_ENQUEUED, type: "SummarizeSessionJob")
+        end
+
+        # Detach: kick the polishing worker so it drains the rows just enqueued
+        # off this thread. Returns immediately — the next prompt is never gated.
+        @polishing&.start(ui: @ui, event_bus: @event_bus)
+      end
+
+      # Deterministic per-session turn counter for the throttle gates (#412/#414).
+      # sessions.message_count grows by a fixed 2 per completed turn
+      # (persist_user_message + update_session_state), so dividing by 2 yields the
+      # turn number. Reads the persisted row (not @session, which is reassigned on
+      # compaction). Falls back to 1 (always-due) if the row can't be read.
+      def current_turn_index
+        row = @session_repo.find(@session[:id])
+        count = row && (row[:message_count] || row["message_count"])
+        count ? [count.to_i / 2, 1].max : 1
+      rescue StandardError
+        1
+      end
+
+      # True when a turn-throttled job is due: every turn for interval <= 1, else
+      # on turns that land on the interval boundary. turn_no is always >= 1.
+      def interval_due?(turn_no, interval)
+        return true if interval.nil? || interval <= 1
 
-        queue.enqueue("SummarizeSessionJob", { session_id: @session[:id] })
-        @event_bus.emit(Events::JOB_ENQUEUED, type: "SummarizeSessionJob")
+        (turn_no % interval).zero?
       end
     end
   end