@aitne/daemon 0.1.10 → 0.1.11

package/dist/core/backends/codex-core.js

@@ -16,7 +16,7 @@ import { buildDaemonApiCliEnv } from "../daemon-api-cli.js";
 import { noteNativeSkillToolIfPresent, probeCliNativeSkillSubcommand, } from "./native-skill-discovery-probe.js";
 import { createOutputCapturePath, CliPathCache, parseJsonLine, readFileIfExists, removeFileIfExists, runLineCommand, } from "./cli-utils.js";
 import { probeApiKeyServerSide } from "./api-key-probe.js";
-import { assertCostWithinMaxBudget, assertPromptCostWithinMaxBudget, classifyCliFailure, } from "./cli-quota-guards.js";
+import { assertCostWithinMaxBudget, assertPromptCostWithinMaxBudget, classifyCliFailure, recoverCliFailureSpend, } from "./cli-quota-guards.js";
 import { auditStreamObservation, extractCodexShellCall, } from "../../safety/subprocess-block-scanner.js";
 import { extractSilentApiErrors, logSilentApiErrors, } from "./silent-api-error-detector.js";
 import { findRegisteredModel, getModelsForBackend, latestLiteFor, } from "./model-registry.js";
@@ -43,7 +43,7 @@ const EMPTY_USAGE = {
  * The delegated path already had this guard (see the `runDelegatedTool`
  * wiring lower in this file); the reactive path needs it explicitly
  * because a single hung subprocess can pin a session for the full
- * executeTimeoutMinutes wall-clock, blocking morning-routine / hourly-check
+ * executeTimeoutMinutes wall-clock, blocking morning-routine / activity-scan
  * dispatch downstream.
  */
 const REACTIVE_IDLE_TIMEOUT_MS = 5 * 60 * 1000;
@@ -669,12 +669,12 @@ export class CodexCore {
             // we still throw a `timeout` failure here because that matches
             // the dispatcher's retry semantics.
             if (idleTimedOut) {
-                const err = new BackendDecisiveFailure(this.backendId, "timeout", new Error(`Codex reactive stream went idle for ${REACTIVE_IDLE_TIMEOUT_MS}ms (no events from CLI subprocess)`));
+                const err = new BackendDecisiveFailure(this.backendId, "timeout", new Error(`Codex reactive stream went idle for ${REACTIVE_IDLE_TIMEOUT_MS}ms (no events from CLI subprocess)`), this.recoverFailureSpend(usage, actualModelId, numTurns, startMs));
                 logger.error({ err, eventType: params.eventType, model: params.modelId, durationMs: Date.now() - startMs }, "Codex execute idle-timed-out");
                 throw err;
             }
             if (runResult.timedOut) {
-                const err = new BackendDecisiveFailure(this.backendId, "timeout", new Error(`Codex execution exceeded timeout of ${this.config.executeTimeoutMinutes} minutes`));
+                const err = new BackendDecisiveFailure(this.backendId, "timeout", new Error(`Codex execution exceeded timeout of ${this.config.executeTimeoutMinutes} minutes`), this.recoverFailureSpend(usage, actualModelId, numTurns, startMs));
                 logger.error({ err, eventType: params.eventType, model: params.modelId, durationMs: Date.now() - startMs }, "Codex execute timed out");
                 throw err;
             }
@@ -723,7 +723,7 @@ export class CodexCore {
                 ?? firstFailureLine(runResult.stdoutLines);
             if (!sawCompletion || runResult.exitCode !== 0) {
                 const failureMsg = combinedFailure ?? "Codex execution did not complete successfully.";
-                const classified = this.classifyFailure(failureMsg);
+                const classified = this.classifyFailure(failureMsg, this.recoverFailureSpend(usage, actualModelId, numTurns, startMs));
                 logger.error({ err: classified, eventType: params.eventType, model: params.modelId, exitCode: runResult.exitCode, durationMs: Date.now() - startMs }, "Codex execute failed");
                 throw classified;
             }
@@ -943,13 +943,29 @@ export class CodexCore {
     // Gemini CLI core; the logic lives in `cli-quota-guards.ts` (single source
     // of truth) and each backend passes its own regexes / label. See that
     // module for the full ordering rationale.
-    classifyFailure(message) {
+    classifyFailure(message, spend) {
         return classifyCliFailure({
             backendId: this.backendId,
             message,
             // OpenAI surfaces quota exhaustion as "rate limit" / "usage limit" / "quota".
             rateLimitPattern: /rate limit|usage limit|quota/i,
             authPattern: /unauthorized|forbidden|api key|login/i,
+            ...(spend !== undefined ? { spend } : {}),
+        });
+    }
+    /**
+     * PREPASS_COST_REDUCTION_PLAN.md N1 — spend recovered from the failed
+     * run's JSONL usage so terminal errors carry what the provider already
+     * billed. Null when the stream never reported usage.
+     */
+    recoverFailureSpend(usage, modelId, numTurns, startMs) {
+        return recoverCliFailureSpend({
+            backendId: this.backendId,
+            priceFetcher: this.priceFetcher,
+            usage,
+            modelId,
+            numTurns,
+            durationMs: Date.now() - startMs,
         });
     }
     assertWithinMaxBudget(costUsd, maxBudgetUsd, modelId, spend) {

package/dist/core/backends/failure-spend.d.ts

@@ -0,0 +1,58 @@
+/**
+ * PREPASS_COST_REDUCTION_PLAN.md N1 — shared post-hoc failure-spend
+ * recording.
+ *
+ * A backend attempt that fails (or is budget-killed) after the provider
+ * has already billed must still land in `agent_actions`, or the cost
+ * dials under-report by the size of every failed turn. Two layers need
+ * the same write:
+ *
+ *  - `DispatcherErrorRouter.handleError` — the throw path, where a
+ *    `BackendRouterHandledError` is unwrapped into its per-backend
+ *    failures (main + fallback can both have billed);
+ *  - `BackendRouter.executeFallbackCore` — the fallback-SUCCESS path,
+ *    where the dispatcher's error path never runs and this module is
+ *    the only place the main attempt's spend can be recorded (and the
+ *    raw-fallback-error rethrow, which bypasses the dispatcher's
+ *    unwrap because the thrown error is not a router wrap).
+ *
+ * Tagging convention: quota errors keep the spend payload's own
+ * `costSource` (`sdk` for Codex/Gemini post-hoc asserts, `sdk_partial`
+ * for Claude budget aborts); non-quota decisive failures are tagged
+ * `cost_source='post_hoc_error'` so failure-spend rows are queryable
+ * as a class.
+ */
+import type Database from "better-sqlite3";
+import type { BackendId } from "@aitne/shared";
+import { type BackendQuotaSpend } from "../agent-core.js";
+/**
+ * One recordable failure-spend: which backend billed it, the recovered
+ * payload, and the `cost_source` tag the audit row should carry.
+ */
+export interface FailureSpendInfo {
+    backendId: BackendId;
+    spend: BackendQuotaSpend;
+    costSource: string | null;
+}
+/**
+ * Recover the recordable spend from one backend failure signal.
+ * Handles the nested `BackendDecisiveFailure(kind="quota",
+ * cause=BackendQuotaError)` wrap the router produces. Returns `null`
+ * when the failure carries no spend (nothing billed, or the
+ * SDK/CLI surfaced no usage before dying).
+ */
+export declare function extractFailureSpendInfo(failure: unknown): FailureSpendInfo | null;
+/**
+ * Write a `result='failed'` agent_actions row carrying the actual spend
+ * for a turn the backend completed (or partially ran) before failing.
+ * One row per distinct billed backend attempt — a fallback-success run
+ * gets a `failed` row for the main attempt next to the ResultProcessor's
+ * `success` row for the fallback.
+ *
+ * Best-effort: a logging failure must not mask the original control
+ * flow — we catch and warn instead of rethrowing.
+ */
+export declare function recordFailureSpendRow(db: Database.Database, event: {
+    correlationId: string;
+    type: string;
+}, spendInfo: FailureSpendInfo, errorMessage: string): void;

package/dist/core/backends/failure-spend.js

@@ -0,0 +1,137 @@
+/**
+ * PREPASS_COST_REDUCTION_PLAN.md N1 — shared post-hoc failure-spend
+ * recording.
+ *
+ * A backend attempt that fails (or is budget-killed) after the provider
+ * has already billed must still land in `agent_actions`, or the cost
+ * dials under-report by the size of every failed turn. Two layers need
+ * the same write:
+ *
+ *  - `DispatcherErrorRouter.handleError` — the throw path, where a
+ *    `BackendRouterHandledError` is unwrapped into its per-backend
+ *    failures (main + fallback can both have billed);
+ *  - `BackendRouter.executeFallbackCore` — the fallback-SUCCESS path,
+ *    where the dispatcher's error path never runs and this module is
+ *    the only place the main attempt's spend can be recorded (and the
+ *    raw-fallback-error rethrow, which bypasses the dispatcher's
+ *    unwrap because the thrown error is not a router wrap).
+ *
+ * Tagging convention: quota errors keep the spend payload's own
+ * `costSource` (`sdk` for Codex/Gemini post-hoc asserts, `sdk_partial`
+ * for Claude budget aborts); non-quota decisive failures are tagged
+ * `cost_source='post_hoc_error'` so failure-spend rows are queryable
+ * as a class.
+ */
+import { BackendDecisiveFailure, BackendQuotaError, } from "../agent-core.js";
+import { createLogger } from "../../logging.js";
+const logger = createLogger("failure-spend");
+/**
+ * Recover the recordable spend from one backend failure signal.
+ * Handles the nested `BackendDecisiveFailure(kind="quota",
+ * cause=BackendQuotaError)` wrap the router produces. Returns `null`
+ * when the failure carries no spend (nothing billed, or the
+ * SDK/CLI surfaced no usage before dying).
+ */
+export function extractFailureSpendInfo(failure) {
+    const quota = failure instanceof BackendQuotaError
+        ? failure
+        : failure instanceof BackendDecisiveFailure
+            && failure.kind === "quota"
+            && failure.cause instanceof BackendQuotaError
+            ? failure.cause
+            : null;
+    if (quota?.spend) {
+        return {
+            backendId: quota.backendId,
+            spend: quota.spend,
+            costSource: quota.spend.costSource ?? null,
+        };
+    }
+    if (failure instanceof BackendDecisiveFailure && failure.spend) {
+        return {
+            backendId: failure.backendId,
+            spend: failure.spend,
+            costSource: "post_hoc_error",
+        };
+    }
+    return null;
+}
+/**
+ * Per-DB memo of whether `agent_actions` carries the migration-added
+ * cache-token columns. Pre-migration databases (the `AuditLogger`
+ * guards the same way) must not make the whole best-effort INSERT
+ * fail just because the optional columns are absent.
+ */
+const cacheColumnSupport = new WeakMap();
+function hasCacheTokenColumns(db) {
+    const cached = cacheColumnSupport.get(db);
+    if (cached !== undefined)
+        return cached;
+    let supported = false;
+    try {
+        const columns = db
+            .prepare("PRAGMA table_info(agent_actions)")
+            .all();
+        const names = new Set(columns.map((c) => c.name));
+        supported = names.has("cache_creation_tokens") && names.has("cache_read_tokens");
+    }
+    catch {
+        supported = false;
+    }
+    cacheColumnSupport.set(db, supported);
+    return supported;
+}
+/**
+ * Write a `result='failed'` agent_actions row carrying the actual spend
+ * for a turn the backend completed (or partially ran) before failing.
+ * One row per distinct billed backend attempt — a fallback-success run
+ * gets a `failed` row for the main attempt next to the ResultProcessor's
+ * `success` row for the fallback.
+ *
+ * Best-effort: a logging failure must not mask the original control
+ * flow — we catch and warn instead of rethrowing.
+ */
+export function recordFailureSpendRow(db, event, spendInfo, errorMessage) {
+    const { spend } = spendInfo;
+    try {
+        const columns = [
+            "event_id",
+            "action_type",
+            "model_used",
+            "cost_usd",
+            "tokens_input",
+            "tokens_output",
+            "duration_ms",
+            "num_turns",
+            "result",
+            "backend",
+            "cost_source",
+            "error",
+            "completed_at",
+        ];
+        const values = [
+            event.correlationId,
+            event.type,
+            spend.modelId,
+            spend.costUsd,
+            spend.usage.inputTokens,
+            spend.usage.outputTokens,
+            spend.durationMs,
+            spend.numTurns,
+            "failed",
+            spendInfo.backendId,
+            spendInfo.costSource,
+            errorMessage.slice(0, 4096),
+            new Date().toISOString(),
+        ];
+        if (hasCacheTokenColumns(db)) {
+            columns.splice(6, 0, "cache_creation_tokens", "cache_read_tokens");
+            values.splice(6, 0, spend.usage.cacheCreationInputTokens, spend.usage.cacheReadInputTokens);
+        }
+        const placeholders = columns.map(() => "?").join(", ");
+        db.prepare(`INSERT INTO agent_actions (${columns.join(", ")}) VALUES (${placeholders})`).run(...values);
+    }
+    catch (err) {
+        logger.warn({ err, eventType: event.type, backendId: spendInfo.backendId }, "Failed to record post-hoc failure spend in agent_actions");
+    }
+}

package/dist/core/backends/gemini-cli-core.d.ts

@@ -300,6 +300,12 @@ export declare class GeminiCliCore implements IAgentCore {
      */
     private incrementRequestsCount;
     private classifyFailure;
+    /**
+     * PREPASS_COST_REDUCTION_PLAN.md N1 — spend recovered from the failed
+     * run's JSONL stats so terminal errors carry what the provider already
+     * billed. Null when the stream never reported usage.
+     */
+    private recoverFailureSpend;
     private assertWithinMaxBudget;
     private assertPromptWithinMaxBudget;
     /**

package/dist/core/backends/gemini-cli-core.js

@@ -19,7 +19,7 @@ import { ALWAYS_DISALLOWED_TOOLS } from "../../safety/always-disallowed.js";
 import { CliPathCache, parseJsonLine, runLineCommand, } from "./cli-utils.js";
 import { isPathInsideOrEqual, jsonStringPathForms, shellPathForms, } from "../path-compat.js";
 import { probeApiKeyServerSide } from "./api-key-probe.js";
-import { assertCostWithinMaxBudget, assertPromptCostWithinMaxBudget, classifyCliFailure, } from "./cli-quota-guards.js";
+import { assertCostWithinMaxBudget, assertPromptCostWithinMaxBudget, classifyCliFailure, recoverCliFailureSpend, } from "./cli-quota-guards.js";
 import { buildAgentDayBoundaryHint } from "./quota-reset-hints.js";
 import { auditStreamObservation, extractGeminiToolUseTarget, } from "../../safety/subprocess-block-scanner.js";
 import { extractSilentApiErrors, logSilentApiErrors, } from "./silent-api-error-detector.js";
@@ -783,7 +783,7 @@ export class GeminiCliCore {
             // the wall-clock case, but the audit trail and operator alert
             // call out the idle hang specifically.
             if (maxTurnsExceeded) {
-                const err = new BackendDecisiveFailure(this.backendId, "max_turns", new Error(`Gemini execution exceeded max-turns cap of ${maxTurns} (observed ${toolCallCount} tool calls).`));
+                const err = new BackendDecisiveFailure(this.backendId, "max_turns", new Error(`Gemini execution exceeded max-turns cap of ${maxTurns} (observed ${toolCallCount} tool calls).`), this.recoverFailureSpend(stats, params.modelId, toolCallCount, startMs));
                 logger.error({
                     err,
                     eventType: params.eventType,
@@ -795,12 +795,12 @@ export class GeminiCliCore {
                 throw err;
             }
             if (idleTimedOut) {
-                const err = new BackendDecisiveFailure(this.backendId, "timeout", new Error(`Gemini reactive stream went idle for ${REACTIVE_IDLE_TIMEOUT_MS}ms (no events from CLI subprocess)`));
+                const err = new BackendDecisiveFailure(this.backendId, "timeout", new Error(`Gemini reactive stream went idle for ${REACTIVE_IDLE_TIMEOUT_MS}ms (no events from CLI subprocess)`), this.recoverFailureSpend(stats, params.modelId, toolCallCount, startMs));
                 logger.error({ err, eventType: params.eventType, model: params.modelId, durationMs: Date.now() - startMs }, "Gemini execute idle-timed-out");
                 throw err;
             }
             if (runResult.timedOut) {
-                const err = new BackendDecisiveFailure(this.backendId, "timeout", new Error(`Gemini execution exceeded timeout of ${this.config.executeTimeoutMinutes} minutes`));
+                const err = new BackendDecisiveFailure(this.backendId, "timeout", new Error(`Gemini execution exceeded timeout of ${this.config.executeTimeoutMinutes} minutes`), this.recoverFailureSpend(stats, params.modelId, toolCallCount, startMs));
                 logger.error({ err, eventType: params.eventType, model: params.modelId, durationMs: Date.now() - startMs }, "Gemini execute timed out");
                 throw err;
             }
@@ -813,7 +813,7 @@ export class GeminiCliCore {
                     ?? firstFailureLine(runResult.stdoutLines)
                     ?? firstFailureLine(runResult.stderrLines)
                     ?? "Gemini execution did not complete successfully.";
-                const classified = this.classifyFailure(failureText);
+                const classified = this.classifyFailure(failureText, this.recoverFailureSpend(stats, params.modelId, toolCallCount, startMs));
                 logger.error({ err: classified, eventType: params.eventType, model: params.modelId, exitCode: runResult.exitCode, durationMs: Date.now() - startMs }, "Gemini execute failed");
                 throw classified;
             }
@@ -1703,7 +1703,7 @@ ${fetchClause}`;
     // Codex core; the logic lives in `cli-quota-guards.ts` (single source of
     // truth) and each backend passes its own regexes / label. Gemini adds a
     // pre-auth policy-deny branch via `classifyGeminiPolicyDeny`.
-    classifyFailure(message) {
+    classifyFailure(message, spend) {
         return classifyCliFailure({
             backendId: this.backendId,
             message,
@@ -1711,6 +1711,25 @@ ${fetchClause}`;
             rateLimitPattern: /rate limit|quota|429/i,
             authPattern: /authentication page|oauth|api key|login|required/i,
             extraClassifier: classifyGeminiPolicyDeny,
+            ...(spend !== undefined ? { spend } : {}),
+        });
+    }
+    /**
+     * PREPASS_COST_REDUCTION_PLAN.md N1 — spend recovered from the failed
+     * run's JSONL stats so terminal errors carry what the provider already
+     * billed. Null when the stream never reported usage.
+     */
+    recoverFailureSpend(stats, modelId, toolCallCount, startMs) {
+        return recoverCliFailureSpend({
+            backendId: this.backendId,
+            priceFetcher: this.priceFetcher,
+            usage: normalizeGeminiUsage(stats),
+            modelId,
+            // Matches the success branch / budget-assert formula
+            // (`toolCallCount + 1`) so a failed and a successful run with the
+            // same tool fan-out report the same turn count.
+            numTurns: toolCallCount + 1,
+            durationMs: Date.now() - startMs,
         });
     }
     assertWithinMaxBudget(costUsd, maxBudgetUsd, modelId, spend) {

package/dist/core/backends/model-registry.d.ts

@@ -6,7 +6,7 @@ import type { BackendId, BackendModel, BackendModelTier, BackendUsage } from "@a
  *
  * Tier semantics (see `BackendModelTier` in shared/backend.ts):
  *   - `LITE`   — delegated proxy + observer-fired short-shape tasks.
- *   - `MEDIUM` — main agent surfaces (DM, routines, hourly check, reviews).
+ *   - `MEDIUM` — main agent surfaces (DM, routines, activity scan, reviews).
  *   - `HIGH`   — heavy reasoning (advisor, knowledge import, generative one-shots).
  *
  * Sources of truth for the alias → API ID mapping:

package/dist/core/backends/model-registry.js

@@ -5,7 +5,7 @@
  *
  * Tier semantics (see `BackendModelTier` in shared/backend.ts):
  *   - `LITE`   — delegated proxy + observer-fired short-shape tasks.
- *   - `MEDIUM` — main agent surfaces (DM, routines, hourly check, reviews).
+ *   - `MEDIUM` — main agent surfaces (DM, routines, activity scan, reviews).
  *   - `HIGH`   — heavy reasoning (advisor, knowledge import, generative one-shots).
  *
  * Sources of truth for the alias → API ID mapping:
@@ -18,7 +18,7 @@ export const DEFAULT_CLAUDE_LITE_MODEL = "claude-haiku-4-5-20251001";
 export const DEFAULT_CLAUDE_MEDIUM_MODEL = "claude-sonnet-4-6";
 export const DEFAULT_CLAUDE_HIGH_MODEL = "claude-opus-4-8";
 // Codex (gpt-5.4-mini is the lite-tier pick; gpt-5.4 is the medium-tier
-// default — morning_routine / hourly_check / evening_review run on this.
+// default — morning_routine / activity_scan / evening_review run on this.
 // gpt-5.5 and gpt-5.5-chat-latest are the flagship reasoning models and
 // stay registered at high tier as selectable opt-ins, but the seeded
 // default for Codex's high tier is also gpt-5.4: gpt-5.5 carries Opus-
@@ -34,7 +34,7 @@ export const DEFAULT_CODEX_HIGH_MODEL = "gpt-5.4";
 // medium-tier flash equivalent left. `gemini-3.1-pro-preview` is priced in
 // the Sonnet band — $0.002/$0.012 per 1k in/out under 200k context, ~2/3
 // the cost of Sonnet 4.6 — so it serves as the "main agent work" pick for
-// every medium-tier surface (morning_routine, message.dm, hourly_check,
+// every medium-tier surface (morning_routine, message.dm, activity_scan,
 // evening / weekly / monthly review). High tier collapses onto the same
 // model via `SEED_HIGH_TIER_OVERRIDE` below: there's no Opus-priced Google
 // flagship worth defaulting to, and operators who genuinely want
@@ -274,7 +274,7 @@ const MODEL_REGISTRY = [
         displayName: "GPT-5.4",
         // Promoted from `high` to `medium` after gpt-5.5 shipped: gpt-5.4 is
         // priced ~half of gpt-5.5 for the same context shapes, and the
-        // medium-tier routines (morning_routine / hourly_check /
+        // medium-tier routines (morning_routine / activity_scan /
         // evening_review / message.dm) do not benefit from gpt-5.5's
         // deeper reasoning enough to justify the cost. gpt-5.4 is ALSO the
         // seeded default for codex's high tier via `SEED_HIGH_TIER_OVERRIDE`

package/dist/core/backends/opencode-core.d.ts

@@ -289,7 +289,7 @@ export declare function auditOpencodeTools(tools: ReturnType<typeof extractToolU
     sessionId: number | null;
 }): void;
 /**
- * docs/design/appendices/opencode-backend.md Phase 4 — Stage 2 hourly-check triage
+ * docs/design/appendices/opencode-backend.md Phase 4 — Stage 2 activity-scan triage
  * schema. Mirrors the `parseStage2Verdict` text contract
  * (`dispatcher-types.ts`): the agent must return exactly
  * `{ "action": "log_only" | "escalate", "reason": string }`. Opencode

package/dist/core/backends/opencode-core.js

@@ -609,7 +609,7 @@ export class OpencodeCore {
             const renderedPrompt = isResume
                 ? params.prompt
                 : buildExecutionPrompt(params.prompt, params.context, params.event, params.conversationHistory);
-            // docs/design/appendices/opencode-backend.md §4 / Phase 4 — `routine.hourly_check.triage`
+            // docs/design/appendices/opencode-backend.md §4 / Phase 4 — `routine.activity_scan.triage`
             // returns a strict JSON envelope (`{ "action": "log_only" |
             // "escalate", … }`) parsed by `parseStage2Verdict`. opencode's
             // `format: { type: "json_schema", … }` honours the schema with
@@ -767,7 +767,7 @@ export class OpencodeCore {
                 const durationMs = Date.now() - startMs;
                 const stopReason = assistantMessage?.finish ?? null;
                 // Best-effort cleanup of the on-disk opencode session row when we
-                // own the workdir — keeps disk usage bounded under hourly_check.
+                // own the workdir — keeps disk usage bounded under activity_scan.
                 // On resume we must never delete: the dispatcher's next turn
                 // needs the same session id to resolve to a live server-side
                 // history. (`ownsSessionDir` is already false when sessionDir is
@@ -1466,7 +1466,7 @@ function classifyStreamError(payload, backendId) {
     return new BackendDecisiveFailure(backendId, "other_non_retryable", new Error(message));
 }
 /**
- * docs/design/appendices/opencode-backend.md Phase 4 — Stage 2 hourly-check triage
+ * docs/design/appendices/opencode-backend.md Phase 4 — Stage 2 activity-scan triage
  * schema. Mirrors the `parseStage2Verdict` text contract
  * (`dispatcher-types.ts`): the agent must return exactly
  * `{ "action": "log_only" | "escalate", "reason": string }`. Opencode
@@ -1493,11 +1493,11 @@ export const STAGE2_TRIAGE_JSON_SCHEMA = {
 /**
  * Returns the opencode `format` envelope to apply when a given process
  * key has a strict structured-output contract; null otherwise. v1
- * covers `routine.hourly_check.triage`; future strict-JSON process
+ * covers `routine.activity_scan.triage`; future strict-JSON process
  * keys (e.g. delegated classifiers) extend this map.
  */
 function formatForProcessKey(processKey) {
-    if (processKey === "routine.hourly_check.triage") {
+    if (processKey === "routine.activity_scan.triage") {
         return {
             type: "json_schema",
             schema: STAGE2_TRIAGE_JSON_SCHEMA,

package/dist/core/backends/plan-presets.js

@@ -222,27 +222,44 @@ const ENVELOPE_OVERRIDES_BY_PROCESS_KEY = {
     // cost-reduction-structural §B — Stage 2 lite-tier triage. Strict
     // JSON-only output (~2K input / ~50 output) decides log_only vs
     // escalate. 1 turn / $0.05 mirrors observation.summarize.
-    "routine.hourly_check.triage": { maxTurns: 1, maxBudgetUsd: 0.05 },
+    "routine.activity_scan.triage": { maxTurns: 1, maxBudgetUsd: 0.05 },
     // docs/design/appendices/routine-data-acquisition.md §6.2 / §6.9 pre-pass fetcher.
     // The lite-tier nominal ($0.20) under-provisioned the morning fan-out
     // (2 mail providers × N accounts + calendar + notion) and tripped
     // BackendQuotaError(max_budget_usd) mid-fetch — widened to $0.50 so
     // the cap still binds well before runaway but accommodates the real
-    // worst-case fan-out. 20-turn turn count is unchanged. Keep in
-    // lock-step with the corresponding schema-seed row.
-    "routine.fetch_window": { maxTurns: 20, maxBudgetUsd: 0.5 },
+    // worst-case fan-out. Keep in lock-step with the corresponding
+    // schema-seed row.
+    //
+    // maxTurns 20 → 10 (PREPASS_COST_REDUCTION_PLAN.md N4, 2026-06-10):
+    // measured over 502 fetch_window runs on a live install, num_turns
+    // P50=3 / P95=6 / P99=8 / max=11 (avg 3.08). The per-integration
+    // fan-out means each session handles ONE partial, so the original
+    // "~6 partials × 3 tool calls" sizing no longer applies. 10 bounds
+    // budget-cap wander (a stuck session now stops at half the previous
+    // exploration depth) while clearing P99 with 2 turns of headroom.
+    "routine.fetch_window": { maxTurns: 10, maxBudgetUsd: 0.5 },
     // BROWSER_HISTORY_INTEGRATION_PLAN P3 — keep these in lock-step with
-    // the schema seed rows. cluster_update is a tiny dispatcher (1 PUT
-    // + a list call), so the absolute floor of 5/$0.05 is the right
-    // envelope. research_offer_dm is even tighter — a single DM
-    // composition (GET /research-clusters/<slug> + POST /api/notify),
-    // 5/$0.02 leaves no room for runaway. research_dispatch carries the
-    // WebFetch fan-out; mirrors evening_review (50/$1.00).
-    // research_wiki_summary is tighter (30/$0.50) — it reads the cluster
-    // journal the agent already wrote and composes from it, with
-    // bounded external work.
-    "routine.research_cluster_update": { maxTurns: 5, maxBudgetUsd: 0.05 },
-    "routine.research_offer_dm": { maxTurns: 5, maxBudgetUsd: 0.02 },
+    // the schema seed rows (research_offer_dm has NO seed row — this
+    // entry is its only default, materialized on main-backend switch or
+    // Reset).
+    //
+    // cluster_update / offer_dm budgets are STOP-LOSSES sized to cover
+    // one cold-prompt-cache run, not per-run cost targets
+    // (RESEARCH_CLUSTER_COST_FIX_PLAN.md RC2/F3): the SDK budget check
+    // only fires between turns, and a cold run writes the full session
+    // prefix to prompt cache (~$0.13-0.30 observed on Haiku) before the
+    // check can abort — the original floor values ($0.05/$0.02) killed
+    // every cold run AFTER the money was spent and the journal was never
+    // written. With the F1 per-agent-day enqueue stamp, cluster_update
+    // runs at most once per cluster per day, so $0.50 bounds daily spend
+    // per cluster. Bumped for upgrading installs by migration 0012.
+    // research_dispatch carries the WebFetch fan-out; mirrors
+    // evening_review (50/$1.00). research_wiki_summary is tighter
+    // (30/$0.50) — it reads the cluster journal the agent already wrote
+    // and composes from it, with bounded external work.
+    "routine.research_cluster_update": { maxTurns: 5, maxBudgetUsd: 0.5 },
+    "routine.research_offer_dm": { maxTurns: 5, maxBudgetUsd: 0.15 },
     "routine.research_dispatch": { maxTurns: 50, maxBudgetUsd: 1.0 },
     "routine.research_wiki_summary": { maxTurns: 30, maxBudgetUsd: 0.5 },
     // BROWSER_TASK_REDESIGN_PLAN.md §5 — open-ended browser sub-agent.
@@ -254,6 +271,13 @@ const ENVELOPE_OVERRIDES_BY_PROCESS_KEY = {
     // cost without tripping BackendQuotaError. Lock-step with the
     // schema-seed row.
     "browser_task": { maxTurns: 30, maxBudgetUsd: 1.0 },
+    // BACKGROUND_TASK_RUNNER_DESIGN.md §6 — generic detached worker. The
+    // medium-tier nominal (50/$1.00) is too tight for long-running research
+    // / multi-repo audits, so the seed picks 40 turns / $2.00 (the
+    // medium-tier base in background-task-budget.ts). Kept in lock-step
+    // with the schema-seed row so a force=true backend-switch reset
+    // preserves this envelope instead of clobbering it to the tier default.
+    "background_task": { maxTurns: 40, maxBudgetUsd: 2.0 },
 };
 /**
  * Resolve the seed `(model, envelope)` for a configurable process key on

package/dist/core/bang-commands/commands-cost.js

@@ -88,7 +88,9 @@ function makeCostBackendCommand(backend) {
     return {
         name: `!cost ${backend}`,
         title: `Cost for ${backend}`,
-        describe: `Agent spend on ${backend} over the past 7 days.`,
+        // Short on purpose — one of these renders per registered backend in
+        // `!help`, and the whole list must fit MOBILE_REPLY_BUDGET.
+        describe: `Agent spend on ${backend} (7 days).`,
         details: [
             `Reports trailing 7-day spend for ${backend}.`,
             "Does not invoke an LLM.",

package/dist/core/bang-commands/commands-report.js

@@ -18,7 +18,7 @@ const REPORT_SQL = `
       MIN(started_at) AS first_seen,
       MAX(started_at) AS last_seen
     FROM agent_actions
-    WHERE result = 'failed'
+    WHERE result IN ('failed', 'partial')
       AND started_at >= datetime('now', '-7 days')
       AND error IS NOT NULL
     GROUP BY backend, action_type
@@ -27,7 +27,7 @@ const REPORT_SQL = `
     ON latest.action_type = g.action_type
    AND COALESCE(latest.backend, 'claude') = COALESCE(g.backend, 'claude')
    AND latest.started_at = g.last_seen
-   AND latest.result = 'failed'
+   AND latest.result IN ('failed', 'partial')
    AND latest.error IS NOT NULL
   GROUP BY g.backend, g.action_type
   ORDER BY g.n DESC, g.last_seen DESC
@@ -42,7 +42,7 @@ function queryReport(db) {
          COUNT(DISTINCT COALESCE(backend, 'claude') || '|' || action_type) AS groups,
          COUNT(*) AS total
        FROM agent_actions
-       WHERE result = 'failed'
+       WHERE result IN ('failed', 'partial')
          AND started_at >= datetime('now', '-7 days')
          AND error IS NOT NULL`)
         .get();
@@ -94,6 +94,7 @@ export const reportCommand = {
     describe: "Agent errors over the past 7 days.",
     details: [
         "Summarizes recent failed agent actions by action type and backend.",
+        "Includes partial runs that failed a post-run outcome check.",
         "Samples are redacted before sending to messaging surfaces.",
         "Does not invoke an LLM.",
     ],

package/dist/core/bang-commands/commands-research.js

@@ -242,7 +242,10 @@ async function handleRename(ctx, slug, newName) {
 export const researchCommand = {
     prefix: "!research",
     title: "Research clusters",
-    describe: "manage browser-history research clusters (list / show / accept / wiki / decline / mute / unmute / rename / conclude)",
+    // Keep this one-liner short: `!help` renders every registered describe
+    // inside the 1500-char MOBILE_REPLY_BUDGET, and the subcommand catalogue
+    // already lives in `details` below (and in the `!research` reply itself).
+    describe: "manage browser-history research clusters",
     details: [
         "Subcommands:",
         "- `!research` — list active clusters",

package/dist/core/bang-commands/commands-revert-tuning.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `!revert tuning` — undo the most recent applied self-tuning config change
+ * (SELF_TUNING_REVIEW_CYCLE_DESIGN.md §3.4, Phase 3).
+ *
+ * The owner-side escape hatch for the Autonomous-plus-DM actuation posture
+ * (D1): every applied change DMs "Reply `!revert tuning` to undo", and this
+ * command is that reply. It restores the ledger's `prev` value through the
+ * same `applyConfigUpdates` chokepoint the actuator used, stamps
+ * `reverted_at` (which puts the key into the 28-day re-proposal cool-down),
+ * audits `self_tuning.reverted`, and records an explicit-correction
+ * feedback signal so the lesson loop learns from the owner's override.
+ *
+ * `runsWhilePaused: true` — a pure DB/config write with no LLM dispatch,
+ * and the owner may well have paused the agent *because* of a bad tuning
+ * change; the undo must not be locked behind `!start`.
+ */
+import { type BangPrefixCommand } from "./registry.js";
+export declare const revertTuningCommand: BangPrefixCommand;